btcpay_server vulnerabilities

CVEs whose affected-version data names the btcpay_server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119757Critical· 9.8

yesterday

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) no…

▾ MidnightBTCPay Server · BTCPay Servervia CVEORG