BTCPay Server 1.3.0 up to and including 1.5.3 allows a remote malicious user to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
btcpayserver btcpay server |
Vulmon