Vulnerability details
CVE-2026-119757
btcpayserver BTCPay Server
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
CVSS 4.0
9.3Critical
Official description
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| btcpayserver | BTCPay Server | v < 2.4.2 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/ vendor-advisorypatch
- https://www.binance.com/en/square/post/384812445203404 technical-description
- https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-06
- Last updated
- 2026-11-06
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.3%
Percentile (among all CVEs)
Weaknesses (CWE)
- CWE-552Files or Directories Accessible to External Parties
- CWE-522Insufficiently Protected Credentials