CVE-2026-117603GHSA-q7m2-785w-r585
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
spesmilo electrum
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.7.2electrumCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 3
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stemshop.bsky.social: 🚨 CVE-2026-117603 — CVSS 9.3 CRITICAL Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin tha... 🔎 https://stemshop.top/cve/CVE-Bluesky: CVE posts, 27 Oct 2026
- @cve.skyfleet.blue: CVE-2026-117603 - Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass CVE ID : CVE-2026-117603 Published : Oct. 27, 2026, 2:16 p.m. | 7 minutes ago DescriBluesky: CVE posts, 27 Oct 2026
- @stackflag.bsky.social: CVE-2026-117603 Versions of Electrum before 4.7.2 allow the Nostr Wallet Connect feature to ignore the daily spending cap. A malicious client could make multiple payment requests tBluesky: CVE posts, 27 Oct 2026
Description
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
Text from CVE List
Affected versions 2
- electrumaffected: all versions before 4.7.2CVE List
- electrumunaffected: 4.7.2CVE List
References 4
- github.com/spesmilo/electrum/commit/5222374046d2a92da371d46c79ce0e61e7e2a42dFixvia CVE List
- github.com/spesmilo/electrum/commit/3956bff0684f6060fbe8c823c3ee921928cdcaa5Fixvia CVE List
- github.com/spesmilo/electrum/security/advisories/GHSA-q7m2-785w-r585Advisoryvia CVE List
- vulncheck.com/advisories/electrum-before-4.7.2-nostr-wallet-connect-plugin-daily-spending-limit-bypassAdvisoryvia CVE List