CVE-2026-117603

Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.7.2

Description The Nostr Wallet Connect plugin contains a flaw that allows malicious clients to bypass spending limits. This is achieved by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay invoice requests that pass the budget allows spend() check before the add to budget() function executes. Additionally, attackers can repeatedly pay amounts in millisatoshi (msat) that are floored to whole satoshis to drain funds beyond the daily limit sat variable.

Recommendations Update to version 4.7.2.