EUVD-2026-117807

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND Lightning Network Daemon node. Attackers can use the exposed macaroon to gain full contro...

CVE-2026-119757

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND Lightning Network Daemon node. Attackers can use the exposed macaroon to gain full contro...

CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND Lightning Network Daemon node. Attackers can use the exposed macaroon to gain full contro...

CVE-2026-119757

BTCPay Server versions before 2.4.2 , including release candidates, are vulnerable to an information disclosure vulnerability. This flaw allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. By obtaining these exposed credential...

VulnCheck KEV: CVE-2026-119757

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND Lightning Network Daemon node. Attackers can use the exposed macaroon to gain full contro...