Overview
This report discusses a significant Server Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-32013, within the LNbits’ LNURL authentication handling functionality. This vulnerability poses a potential threat to system security and data confidentiality. It affects all entities utilizing LNbits, a popular Lightning wallet and accounts system. The vulnerability allows unauthorized access to internal network addresses, thereby compromising system data.
Vulnerability Summary
CVE ID: CVE-2025-32013
Severity: High (CVSS Score 7.5)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
LNbits | All versions prior to patched release
How the Exploit Works
The LNbits’ LNURL authentication handling functionality processes authentication requests without properly validating the callback URL. It accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library. With redirect following enabled, an attacker can manipulate the callback URL to specify internal network addresses. This allows unauthorized access to internal resources, potentially leading to system compromise and data leakage.
Conceptual Example Code
Here is a hypothetical example of how the vulnerability might be exploited using a malicious HTTP request:
GET /lnurl-auth?callback=http://internal-network-resource HTTP/1.1
Host: vulnerable-lnbits-serverIn this example, the attacker specifies an internal network resource as the callback URL. The LNbits server, failing to validate the URL, makes a request to this internal resource, potentially exposing sensitive information or functionality to the attacker.
Mitigation Guidance
To mitigate the potential impact of this vulnerability, users are advised to apply the vendor patch as soon as it becomes available. In the interim, implementing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may serve as a temporary mitigation strategy. These systems can help detect and prevent malicious requests exploiting this vulnerability.
