CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

CriticalCVSS 9.3

Published: 2026-11-05 23:44
Updated: 2026-11-05 23:44
Exploit status: No public exploit known

Description

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Affected products

Product	Affected versions	Fixed in
btcpayserver/btcpayserver	< 2.4.2	2.4.2

References

Vendor Advisory patch vendor-advisory
Exploitation Announcement technical-description
VulnCheck Advisory: BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · vulncheck
v3.1 9.8 · vulncheck

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-522 Insufficiently Protected Credentials CWE-552 Files or Directories Accessible to External Parties

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.