Live › vulnerability › CVE-2026-117603
Go to dashboardElectrum before 4.7.2 has a Nostr Wallet Connect plugin where concurrent pay_invoice requests race past the daily spending check, and millisatoshi amounts are truncated, letting a malicious NWC client drain more than the configured daily_limit_sat. The sources describe this as a loss of funds beyond the set limit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Only users running Electrum with the Nostr Wallet Connect plugin enabled and at least one NWC client connected are exposed, since the flaw is in how that plugin enforces its budget. Wallets without the plugin or without paired NWC clients are not affected by this flaw.
No product ranges from the sources yet.
electrum version and confirm whether it is below 4.7.2.daily_limit_sat setting in the NWC plugin configuration.4.7.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
This page as .md · .json · in your agent: get_signal("CVE-2026-117603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.