CVE-2026-117603

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117603", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-27T13:04:09.906Z", "datePublished": "2026-10-27T13:09:52.728Z", "dateUpdated": "2026-11-02T16:01:22.924Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:09:52.728Z"}, "datePublic": "2026-04-28T00:00:00.000Z", "title": "Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass", "descriptions": [{"lang": "en", "value": "Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition", "cweId": "CWE-367", "type": "CWE"}]}], "affected": [{"vendor": "spesmilo", "product": "electrum", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "4.7.2"}, {"version": "4.7.2", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:electrum:electrum:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.7.2"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-q7m2-785w-r585)"}, {"url": "https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass"}], "credits": [{"lang": "en", "value": "maru1009", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T16:01:12.487892Z", "id": "CVE-2026-117603", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:01:22.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-117603", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T16:01:12.487892Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:01:17.839Z"}}], "cna": {"title": "Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass", "credits": [{"lang": "en", "type": "reporter", "value": "maru1009"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "spesmilo", "product": "electrum", "versions": [{"status": "affected", "version": "0", "lessThan": "4.7.2", "versionType": "semver"}, {"status": "unaffected", "version": "4.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T00:00:00.000Z", "references": [{"url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585", "name": "GitHub Security Advisory (GHSA-q7m2-785w-r585)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass", "name": "VulnCheck Advisory: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electrum:electrum:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.7.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:09:52.728Z"}}}, "cveMetadata": {"cveId": "CVE-2026-117603", "state": "PUBLISHED", "dateUpdated": "2026-11-02T16:01:22.924Z", "dateReserved": "2026-10-27T13:04:09.906Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-27T13:09:52.728Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "electrum", "vendor": "spesmilo", "versions": [{"lessThan": "4.7.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "4.7.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit."}], "id": "CVE-2026-117603", "lastModified": "2026-11-02T16:17:31.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-117603", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T16:01:12.487892Z", "version": "2.0.3"}}]}, "published": "2026-10-27T14:16:40.233", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "electrum: Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass", "id": "2561978", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561978"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.", "A flaw was found in the Nostr Wallet Connect (NWC) plugin for Electrum. Due to race conditions in budget validation and improper rounding of fractional payment units, an attacker connected to the wallet can bypass configured daily spending limits. By sending concurrent payment requests or repeatedly submitting fractional payment amounts, a malicious client can deplete wallet balances beyond authorized thresholds."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-117603", "public_date": "2026-10-27T13:09:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117603\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117603\nhttps://github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5\nhttps://github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42d\nhttps://github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585\nhttps://www.vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypass"], "statement": "This vulnerability is evaluated as Critical because remote attackers can completely bypass intended daily spending thresholds to deplete wallet balances without requiring privileged authorization. However, Red Hat Enterprise Linux and the broader Red Hat product portfolio do not distribute or support the Electrum client or its plugins. Consequently, standard Red Hat enterprise deployments and supported software stacks are unaffected by this security flaw.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.7.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "electrum", "source": "cna", "vendor": "spesmilo"}, "product": "electrum", "vendor": "electrum"}], "created": "2026-10-27T14:45:03.609633+00:00", "updated": "2026-10-27T15:15:04.290103+00:00", "vendors": ["electrum", "electrum$PRODUCT$electrum"]}