BTCPay Server has released version 2.4.2 after disclosing a critical vulnerability that it said was under active exploitation. The issue affected the software layer used by merchants to accept Bitcoin payments and did not involve a flaw in the Bitcoin protocol itself.

The project urged operators to upgrade immediately, update NBXplorer to version 2.6.10, review access logs, and move away from Greenfield API Basic Authentication where possible in favor of scoped API keys.

How the flaw worked

According to the project’s disclosure and the related GitHub pull request #7491, the bug allowed attackers to bypass TOTP-based two-factor authentication through BTCPay’s Greenfield API Basic Authentication flow.

The problem stemmed from how the authentication logic handled two-factor checks. Instead of verifying whether two-factor authentication was actually enabled on an account, the mechanism checked whether valid FIDO2 credentials were registered. As a result, accounts protected with a TOTP authenticator app could reach the API using only an email address and credentials.

Who was affected

The vulnerability applied to BTCPay’s application layer, meaning the risk sat in the merchant software stack rather than in Bitcoin itself. That distinction is central to the incident: the blockchain was not described as compromised, but merchants running the affected software could still face fund loss if their systems were abused.

BTCPay is widely used as self-hosted payment infrastructure, so the burden of remediation falls on individual operators. The project warned that simply waiting for a hosted service provider to patch the issue is not an option for those running their own deployments.

Emergency patch and recommended actions

BTCPay shipped version 2.4.2 on August 7 and described the release as addressing a critical vulnerability already being exploited. At the same time, it told operators to update NBXplorer to version 2.6.10 as part of the response.

The project also advised operators to review access logs and replace Basic Authentication with API keys where possible. Scoped API keys offer more fine-grained permissions, which can reduce exposure compared with broader credential-based access. BTCPay said operators should also expect authentication changes so the system checks whether two-factor protection is actually active.

Security issue did not move the broader Bitcoin market

The report said Bitcoin’s market reaction was muted despite the security incident affecting merchant payment infrastructure. At the time cited, Bitcoin traded around $64,889, up 0.82% over the prior day, while its market capitalization stood near $1.3 trillion, a 0.79% increase.

That muted price response does not change the operational significance of the flaw for merchants. The incident highlights how software built around Bitcoin can create serious risks even when the underlying network continues to operate as designed.

Relevant context and the next step for operators

The source article noted that BTCPay has dealt with serious bugs before, including CVE-2022-32984, an information leak affecting versions 1.3.0, 1.4.0 and 1.5.3 that was patched in version 1.5.4.

For now, the next confirmed step is straightforward: operators need to deploy BTCPay Server 2.4.2, update NBXplorer to 2.6.10, inspect logs for suspicious access, and switch to scoped API keys instead of Basic Authentication wherever practical.

Source: Cryptopolitan