Description

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-05T22:17:53.203Z",
  "pubdate": "2026-11-05T22:17:53.203Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified in BTCPay Server versions prior to 2.4.2, including release candidates. The defect permits unauthenticated remote attackers to retrieve sensitive .macaroon credential files associated with the LND (Lightning Network Daemon) node integrated into the platform.\nThe exposure of these macaroon files is critical, as they function as bearer authentication tokens providing administrative control over the Lightning node. Successful exploitation grants an attacker full command execution capabilities over the node's wallet and channel management functions.\nThe risk implication is severe, as it facilitates the unauthorized movement of funds, potentially leading to total financial loss for the affected deployment. Because the vulnerability is accessible to unauthenticated remote actors, it requires no prior system access or user interaction. Immediate remediation via version upgrade is required to eliminate the exposure vector and secure the node's authentication architecture.",
  "technicalDetails": "The vulnerability originates from improper access control handling within BTCPay Server, which results in the exposure of sensitive filesystem objects. Specifically, the application architecture fails to restrict access to the .macaroon files utilized by the LND node for authentication and authorization.\nLND utilizes macaroon-based authentication to manage administrative requests. These files contain cryptographically signed caveats that define the scope of permissions granted to the bearer. In affected BTCPay Server deployments, an attacker can leverage an unauthenticated request to traverse or access the directory path where these files reside, bypassing intended security boundaries.\nThe attack flow follows a predictable sequence: First, the attacker identifies a public-facing instance of an affected BTCPay Server version. Second, the attacker crafts a request targeting the specific path containing the LND credentials. Because the application logic fails to perform sufficient authentication or path validation for this resource, the server inadvertently returns the contents of the .macaroon file in the HTTP response.\nOnce the attacker successfully retrieves the .macaroon file, the payload behavior shifts from information disclosure to full unauthorized access. By providing the stolen macaroon alongside the required TLS certificate (if necessary) or by utilizing the macaroon’s inherent administrative privileges, the attacker can interface directly with the LND RPC (Remote Procedure Call) interface. This grants the attacker the ability to issue commands such as 'sendpayment', 'openchannel', or 'closechannel' without legitimate authorization.\nThe post-exploitation impact is catastrophic, as the attacker effectively assumes the identity of the node administrator. The attacker can drain on-chain and off-chain funds by redirecting payments or unilaterally closing channels to exfiltrate balances to a controlled wallet address. The vulnerability is categorized as a critical-severity disclosure flaw due to the lack of required authentication, the triviality of the exploit vector, and the irreversible nature of the resulting financial theft."
}