🚨🚨 URGENT: BTCPAYSERVER 🚨🚨
There is a critical vulnerability that is being actively exploited on BTCPay Server which can lead to loss of funds.
Update your BTCPayServer to to 2.4.2 or turn off your BTCPayServer now.
Login to reply
Replies (27)
Dammit, I was about to get dinner.
Damn! Is there anything left standing after this month?
Thank you
Is this a finding of "red team"?
Sorry😂
🚨🚨Critical alert if you use BTCPay Server in your community 🚨🚨 Act now
View quoted note →
Upgrade btcpay
View quoted note →
Damn 😮 next on eco system list is lightning node implementations. Could also be a big haul.
What is BTCPayServer? 🫣
Turn off your BTCPay Server immediately if you can’t update right now.
View quoted note →
What merchants use to accept Bitcoin the proper way. It also allows to have Lightning Address, user accounts, boltcards (contactless Lightning Bitcoin payment cards), do swap for fiat or Lightning to on-chain...
A lot of use case and supposedly the most advanced and serious open source app for these use cases. Good that they patch so fast, too bad that many node OS have delay for updates (some times weeks or a month late...).
Did they find it first or was the exploit happening
Where is the information about the vulnerability?
Github release notes lists the bypass of two factor auth but I suppose there might be an additional critical vulnerability:
GitHub
Release 2.4.2 · btcpayserver/btcpayserver
This release contains fix of a critical vulnerability that is being actively exploited. You need to update as fast as you can.
We recommend integra...
My physical gold under the pillow 😘🔪
Pessoal, alerta de mais uma vulnerabilidade. Se você usa BTCPay, tome cuidado.
View quoted note →
go red team go
View quoted note →
bruh
Thanks for saving us💜
Thanks for the urgent warning. However, a little more info would be very useful!
Is it only LND macaroons that are vulnerable?
So much hurry so I accidentally deleted LND storage (so lost channels).
But if I would be lazy, I would be safe because my BtcPay had access only to the receive-only keys.
View quoted note →
View quoted note →
Go work on ethereum and leave bitcoin alone.
It does seem plausible. Its at least a very irresponsible way of "helping"/approach to responsible disclosure.