BTCPay Server Patches API Key Vulnerability
Update restricts excessive permissions though the official release is pending
Security Editor: Fabricio Marcilio 1 min read
BTCPay Server has implemented a code fix to limit the scope of API keys. The change, consolidated on October 19, prevents credentials with broad permissions in a single store from accessing functions across the entire server or account.
Developer Nicolas Dorier integrated the modification into the project's main branch. The goal is to prevent external integrations from gaining authority beyond what is necessary for processing Bitcoin payments.
As of October 26, the latest version listed by the software remained 2.4.5, dated October 6. This means the security update has not yet been officially released to end users through standard distribution channels.
The flaw allowed store-scoped keys to bypass security restrictions on administrative operations. New regression tests ensure that standard user keys cannot perform actions such as account deletion even if they hold elevated permissions within a specific context.
The change in authorization control adjusts how the system validates requests without a defined scope. The software now denies server-level or account-level permissions if the key lacks the necessary privileges, strengthening protection for merchant data.
Spotted an error? Write to suporte@criptoico.com.br.
More in Security
-
Electrum Wallet Flaw Allows Bitcoin Theft During Transactions
Malicious servers tricked users trying to boost pending payments with higher fees
Security
-
CoinDCX Confirms $16 Million Loss Following Security Breach
The exchange states the loss was absorbed internally and client balances remain untouched.
Security
-
Initia Network Hack Drains USDC Reserves from Asset Bridge
Vulnerability exploit reduced collateral to just 63 dollars and halted user withdrawals on the platform.
Security