CVE-2026-117603

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily limit sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay invoice requests that pass budget allows spend() before add to budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.