We have confirmed a critical vulnerability in Alby Hub v1.7.0–v1.18.5 (releases prior to August 2025) when the Hub is publicly accessible from the internet. The vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds.
Alby Hub v1.19.0 (released Aug 29, 2025) or newer are unaffected.
captjack 🏴☠️✨💜
npub1te…mjgwp
2026-09-09 08:48:04 UTC
in reply to nevent1q…33jt
Author Public Key
npub1te0uzs6vj29umjaxlqqct82j8q6ppyefrxq06dhr8d6pvwfatgkqjmjgwpPublished at
2026-09-09 08:48:04 UTCEvent JSON
{
"id": "f6ceb2d931b3573153e509fd7b02a49c2d81c69be58208726983963ab33f508e",
"pubkey": "5e5fc1434c928bcdcba6f801859d5238341093291980fd36e33b7416393d5a2c",
"created_at": 1788943684,
"kind": 1,
"tags": [
[
"e",
"b72159fdb40da17a1df180fa09bbdcfe0de25ddf43bc781421c648718def2a3f",
"wss://nostr.superfriends.online/",
"root",
"5e5fc1434c928bcdcba6f801859d5238341093291980fd36e33b7416393d5a2c"
],
[
"e",
"7b0dabe9f82996ebeed954713831b28702c1bf1cf184960523948b7ddc7aed28",
"wss://nostr.superfriends.online/",
"reply",
"4180da638a2579c5187be5d2129cd2fd2ba6244a8f9f4dd99092b4487b3c147e"
],
[
"p",
"4180da638a2579c5187be5d2129cd2fd2ba6244a8f9f4dd99092b4487b3c147e"
]
],
"content": "We have confirmed a critical vulnerability in Alby Hub v1.7.0–v1.18.5 (releases prior to August 2025) when the Hub is publicly accessible from the internet. The vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds.\n\nAlby Hub v1.19.0 (released Aug 29, 2025) or newer are unaffected.",
"sig": "1c3b869fe8a0b467f063479c4cf1e1c0e03ca051b1a40dc41669960e309d40a1413cd6166c32262c6e75a2a1217c058c1d002273f603274c468f5bc3667a5741"
}