Critical severity9.8NVD Advisory· Published Nov 5, 2026

CVE-2026-119757

Description

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments.

Affected products

btcpayserver/btcpayserverllm-fuzzy
Range: <2.4.2

Patches

Vulnerability mechanics

References

blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/nvd
www.binance.com/en/square/post/384812445203404nvd
www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosurenvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000