BTCPay Server
CVE-2026-119757: BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to
CVE-2026-119757 Nov 5, 2026 Source: Vendor
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-119757
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-119757
BR2026-0000-042688
unclaimed
Credited as Craig Raw
CVE-2026-119757
BR2026-0000-042689
unclaimed
Credited as Team Red