Btcpayserver exploit explained: The old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), Fido2Credentials.Any() was false, so the API accepted username+password and never asked for the TOTP code. An attacker who obtained your password (reuse, phishing, a leak, brute force) could authenticate straight into Greenfield and skip the second factor entirely, then call spend endpoints.

GitHub

Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491) · btcpayserver/btcpayserver@c173a91

Accept Bitcoin payments. Free, open-source & self-hosted, Bitcoin payment processor. - Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491) · b...