CVE-2024-34694

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

• CWE-754

• https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww
• https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww

Published

Jun 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34689WebFlow Services of SAP Business Workflow allows an authenti…5
• CVE-2024-3469The GP Premium plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2024-34690SAP Student Life Cycle Management (SLcM) fails to conduct pr…5.4
• CVE-2024-34691Manage Incoming Payment Files (F1680) of SAP S/4HANA does no…6.5
• CVE-2024-34692Due to missing verification of file type or content, SAP Ena…4.6
• CVE-2024-34693Improper Input Validation vulnerability in Apache Superset, …5.3
• CVE-2024-34695WOWS Karma is a reputation system for Wargaming's World of W…6.3
• CVE-2024-34696GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-34697FreeScout is a free, self-hosted help desk and shared mailbo…6.1
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2