Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Electrum Nostr Wallet Connect can exceed daily spend limit

CVE-2026-117603 · published today
Summary

Versions of Electrum before 4.7.2 allow the Nostr Wallet Connect feature to ignore the daily spending cap. A malicious client could make multiple payment requests that slip past the check and drain more money than intended. Upgrade Electrum to version 4.7.2 or later to fix the issue.

Original advisory text
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget c...
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CVE-2026-117603 · NVD
Track software like this
Free during beta