CVE-2026-119757

Summary

BTCPay Server before 2.4.2 exposes unauthenticated access to .macaroon credential files for LND nodes, allowing remote attackers to obtain highly privileged authentication tokens without credentials.

Exploitability

Trivial to exploit; requires only an HTTP request to a publicly accessible endpoint with no authentication, authorization, or user interaction.

Blast radius

Full compromise of the LND node including theft of all funds under its control, potentially affecting multiple users' wallets and undermining trust in the BTCPay Server deployment.

Detection

Look for HTTP GET requests to paths ending in .macaroon from unauthenticated sessions (e.g., missing Authorization header) in web server logs; such requests should never succeed.

Prioritized remediation

Upgrade to BTCPay Server version 2.4.2 or later, which patches the vulnerability by restricting access to .macaroon files.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.