BTCPay Server Patch Addresses Critical Bitcoin Security Vulnerability

Cryptorank

BTCPay Server Patch Addresses Critical Bitcoin Security Vulnerability

First seen 8 Aug 2026, 17:35 UTC • •72.0

Article Content

1 / 4

Browse articles

ThreatCluster •August 9, 2026 at 15:34 UTC

•A critical vulnerability in BTCPay Server allows bypassing of TOTP two-factor authentication.
•Merchants are urged to upgrade to BTCPay version 2.4.2 and NBXplorer version 2.6.10.
•The vulnerability does not affect Bitcoin's core protocol but poses risks to merchant funds.

BTCPay Server released an emergency update on August 7, 2026, to address a vulnerability (GitHub PR #7491) that allowed cybercriminals to bypass TOTP two-factor authentication via its Greenfield API Basic Authentication. This flaw potentially exposed merchant wallets to theft, as attackers could access accounts using only email and credentials. The vulnerability stems from an authentication check that failed to verify if the two-factor system was enabled. Merchants using BTCPay are advised to upgrade to version 2.4.2 and NBXplorer to version 2.6.10 to mitigate risks. Despite the vulnerability, Bitcoin's market price remains stable at $64,889, with a market cap of $1.3 trillion. The incident highlights the importance of rapid updates in maintaining trust and security in cryptocurrency transactions. BTCPay's self-hosted nature means operators must implement the patch independently.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 90d ago How this analysis works

Timeline

2026-08-07

Emergency patch released for BTCPay Server

BTCPay Server launched version 2.4.2 to fix a critical vulnerability allowing TOTP bypass.

2026-08-08

Vulnerability actively exploited

Cybercriminals exploited a flaw in BTCPay's authentication, risking merchant funds.

More articles in this cluster (3)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Data Breach
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application

Organization (1)

BTCPay Server

Vulnerability (1)

CVE-2022-32984

Weakness (1)

CWE-287 - Improper Authentication

Affected Platform (3)

Bitcoin
Greenfield API
NBXplorer

Relationships

CVE-2022-32984 targets Bitcoin
CVE-2022-32984 targets Greenfield API
CVE-2022-32984 targets NBXplorer
Data Breach targets Bitcoin
Data Breach targets Greenfield API
Data Breach targets NBXplorer
T1078 - Valid Accounts targets Bitcoin
T1078 - Valid Accounts targets Greenfield API
T1078 - Valid Accounts targets NBXplorer
T1190 - Exploit Public-Facing Application targets Bitcoin
T1190 - Exploit Public-Facing Application targets Greenfield API
T1190 - Exploit Public-Facing Application targets NBXplorer
CVE-2022-32984 related to BTCPay Server
CVE-2022-32984 related to CWE-287 - Improper Authentication

Following this threat?

Track BTCPay Server and CVE-2022-32984 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…