{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.12.12"}],"component":"lnbits","cve_ids":["CVE-2025-32013"],"ecosystem":"PyPI","epss":0.0066,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qp8j-p87f-c8cc","id":"tcs_01M5KFWDA3Y42CZB0X454MZJK3","modified_at":"2026-06-10T17:14:16.701455559Z","published_at":"2025-04-07T16:54:36Z","references":["https://osv.dev/vulnerability/GHSA-qp8j-p87f-c8cc","https://github.com/lnbits/lnbits/security/advisories/GHSA-qp8j-p87f-c8cc","https://nvd.nist.gov/vuln/detail/CVE-2025-32013","https://github.com/lnbits/lnbits","https://github.com/pypa/advisory-database/tree/main/vulns/lnbits/PYSEC-2025-16.yaml"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-qp8j-p87f-c8cc","url":"https://osv.dev/vulnerability/GHSA-qp8j-p87f-c8cc"},{"source":"nvd","source_id":"CVE-2025-32013","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32013"}],"summary":"LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback"}