CVE-2025-32013
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Apr 6, 2025
Updated: Apr 8, 2025
CWE ID 918
Summary
CVE-2025-32013 is a Server-Side Request Forgery (SSRF) vulnerability affecting LNbits, a Lightning wallet and accounts system. The issue lies in the LNURL authentication handling functionality, which accepts a callback URL parameter and subsequently makes an HTTP request to that URL using the httpx library with redirect following enabled. The vulnerability allows attackers to specify malicious internal network addresses, resulting in unauthorized access to internal resources.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.