Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

Advisories

Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

Severity: critical
Date: 10/27/2026
Affecting: electrum >= 0, < 4.7.2
CVE: CVE-2026-117603
CWE: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CVSS: 9.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: GitHub Security Advisory (GHSA-q7m2-785w-r585)
Patch Commit
Patch Commit
Credit: maru1009
Description: Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo