Eclair Patches Security Vulnerability in Lightning Network
Version 0.14.4 blocks malicious browser-based commands on Bitcoin nodes
Security Editor: Fabricio Marcilio 1 min read
The Eclair Bitcoin Lightning node software released version 0.14.4 on October 15. This update addresses a vulnerability that allowed unauthorized command execution through web browsers.
The flaw occurred when an operator's browser held cached HTTP Basic authentication credentials. Malicious web pages could submit HTML forms that leveraged these saved credentials to interact with the node API without user consent.
The attack allowed third parties to send commands to read the node state. It was also possible to open or close channels and process payments by exploiting this security gap.
The new version blocks access by returning an HTTP 403 error whenever an origin header is present in the request. Legitimate browser interfaces now require an intermediary backend to communicate with the software.
Developers emphasize that command-line access remains unchanged. They recommend that all operators install the update to protect the integrity of their nodes and funds on the Lightning network.
Spotted an error? Write to suporte@criptoico.com.br.
More in Security
-
CoinDCX Confirms $16 Million Loss Following Security Breach
The exchange states the loss was absorbed internally and client balances remain untouched.
Security
-
Initia Network Hack Drains USDC Reserves from Asset Bridge
Vulnerability exploit reduced collateral to just 63 dollars and halted user withdrawals on the platform.
Security
-
US Charges Man in $37 Million USDT Money Laundering Scheme
A Chinese national was extradited after a scheme used a Bahamas bank to convert stolen American funds into stablecoins.
Security