Security· ★★· neutral·

BTCPay merges API key permission fix, but latest release still lacks the patch

  • —Patch narrows fallback so a grant from any store no longer passes server or account checks
  • —Key creation now validates requested permissions against the caller's own grants
  • —Release 2.4.5 dated Oct. 6 still contains the pre-patch permission checks
  • —No confirmed exploitation or losses reported in the public PR
Why it matters: Merchants sharing broad API keys with integrations stay exposed until a patched release ships.
#BTC
Source: CryptoSlate
More on this
Security · Sep 14
BTCPay Server releases 2.4.4 update after attacks on LND API
 Security · Oct 12
Eclair merges fixes for Lightning flaws that could burn Bitcoin in fees
 Security · Sep 14
LDK releases v0.2.6 patch fixing two critical Lightning Network vulnerabilities