BTCPay emergency patch exposes merchant-side Bitcoin security risk

An emergency update has been rolled out by BTCPay Server, the open-source software merchants use to accept Bitcoin, due to a vulnerability being exploited to potentially steal funds from users.

As identified in GitHub pull request #7491, this vulnerability enables cybercriminals to circumvent the TOTP two-factor security mechanism through BTCPay’s Greenfield API Basic Authentication. The reason for the vulnerability lies in the fact that the authentication mechanism checked whether valid FIDO2 credentials were registered rather than actually checking whether the two-factor system was even enabled. Thus, the accounts secured with a TOTP authenticator application could access the API using only their email and credentials.

It is important to note that the vulnerability exists within the application layer of BTCPay, not in the Bitcoin (BTC) protocol.

BTCPay has launched version 2.4.2 of its software on August 7 while also advising users to make sure they have updated to the version 2.6.10 of NBXplorer. The upgraded software addresses a “critical vulnerability” that is currently being exploited.

… Continue reading the full article at the original source below.