https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:32:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-227290 EUVD-2026-227290 https://cve.radiocsirt.org/vuln/euvd-2026-227290 https://cve.radiocsirt.org/vuln/fkie_cve-2025-32013 <p>LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> <p>LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-32013 https://cve.radiocsirt.org/vuln/ghsa-qp8j-p87f-c8cc <p><strong>Affected:</strong> PyPI: lnbits</p> <p># Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System</p> <p>## Disclaimer</p> <p>This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.</p> <p>## Description</p> <p>A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. The vulnerability exists in the LNURL authentication callback process where the application makes HTTP requests to user-provided callback URLs and follows redirects without proper validation.</p> <p>When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> <p>This vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal network locations, potentially exposing sensitive information or accessing internal services that should not be accessible from the internet.</p> <p>## Steps to Reproduce</p> <p>1. Create a new wallet account to get an admin k…</p> <p><strong>Affected:</strong> PyPI: lnbits</p> <p># Server-Side Request Forgery via LNURL Authentication Callback in LNbits Lightning Network Payment System</p> <p>## Disclaimer</p> <p>This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.</p> <p>## Description</p> <p>A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. The vulnerability exists in the LNURL authentication callback process where the application makes HTTP requests to user-provided callback URLs and follows redirects without proper validation.</p> <p>When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> <p>This vulnerability allows an attacker to make the application send HTTP requests to arbitrary internal network locations, potentially exposing sensitive information or accessing internal services that should not be accessible from the internet.</p> <p>## Steps to Reproduce</p> <p>1. Create a new wallet account to get an admin k…</p> https://cve.radiocsirt.org/vuln/ghsa-qp8j-p87f-c8cc https://cve.radiocsirt.org/vuln/pysec-2025-16 <p><strong>Affected:</strong> PyPI: lnbits</p> <p>LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> <p><strong>Affected:</strong> PyPI: lnbits</p> <p>LNbits is a Lightning wallet and accounts system. A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits&#39; LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn&#39;t properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.</p> https://cve.radiocsirt.org/vuln/pysec-2025-16