{"id":86174,"date":"2025-12-31T23:01:56","date_gmt":"2025-12-31T23:01:56","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T06:00:00","slug":"cve-2025-32013-ssrf-vulnerability-in-lnbits-lnurl-authentication-handling-functionality","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-32013-ssrf-vulnerability-in-lnbits-lnurl-authentication-handling-functionality\/","title":{"rendered":"<strong>CVE-2025-32013: SSRF Vulnerability in LNbits&#8217; LNURL Authentication Handling Functionality<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>This report discusses a significant Server Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-32013, within the LNbits&#8217; LNURL authentication handling functionality. This vulnerability poses a potential threat to system security and data confidentiality. It affects all entities utilizing LNbits, a popular Lightning wallet and accounts system. The vulnerability allows unauthorized access to internal network addresses, thereby compromising system data.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-32013<br \/>\nSeverity: High (CVSS Score 7.5)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: System compromise and potential data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-2253936928\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>LNbits | All versions prior to patched release<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The LNbits&#8217; LNURL authentication handling functionality processes authentication requests without properly validating the callback URL. It accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library. With redirect following enabled, an attacker can manipulate the callback URL to specify internal network addresses. This allows unauthorized access to internal resources, potentially leading to system compromise and data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-3386364495\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Here is a hypothetical example of how the vulnerability might be exploited using a malicious HTTP request:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/lnurl-auth?callback=http:\/\/internal-network-resource HTTP\/1.1\nHost: vulnerable-lnbits-server<\/code><\/pre>\n<p>In this example, the attacker specifies an internal network resource as the callback URL. The LNbits server, failing to validate the URL, makes a request to this internal resource, potentially exposing sensitive information or functionality to the attacker.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>To mitigate the potential impact of this vulnerability, users are advised to apply the vendor patch as soon as it becomes available. In the interim, implementing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may serve as a temporary mitigation strategy. These systems can help detect and prevent malicious requests exploiting this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview This report discusses a significant Server Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-32013, within the LNbits&#8217; LNURL authentication handling functionality. This vulnerability poses a potential threat to system security and data confidentiality. It affects all entities utilizing LNbits, a popular Lightning wallet and accounts system. The vulnerability allows unauthorized access to internal network [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86174","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/86174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=86174"}],"version-history":[{"count":0,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/86174\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=86174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=86174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=86174"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=86174"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=86174"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=86174"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=86174"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=86174"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=86174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}