Spending Limit Bypass in Electrum Nostr Wallet Connect Plugin

CVE-2026-117603

What is CVE-2026-117603?

Electrum prior to version 4.7.2 is vulnerable to a spending limit bypass in the Nostr Wallet Connect plugin. Malicious clients can exploit this flaw to exceed defined spending limits by leveraging non-atomic budget checks and the truncation of millisatoshis. Attackers can initiate simultaneous pay_invoice requests that exploit the sequence of budget checks, allowing them to drain funds beyond the configured daily limit. Users are advised to update to at least version 4.7.2 to mitigate this risk.

References