CVE-2026-117603

MEDIUM 4.3

Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.

CWE	CWE-367
Vendor	spesmilo
Product	electrum
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for spesmilo electrum

Be the first to know when new medium vulnerabilities affecting spesmilo electrum are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

spesmilo / electrum

0 < 4.7.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585 github.com: https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d github.com: https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5 vulncheck.com: https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass

Credits

🔍 maru1009