According to the official changelog, it was just a 2FA bug. No risk of loss of funds if you have a strong password.
Having said that, BTCPay did the right thing by labeling it as a vulnerability, and I'd rather have them inflate its severity than try to downplay it. I wouldn't call it "critical", but I have no qualms about our difference of opinion.
Besides, there are probably some people out there who are using admin/password1 and were only not pwned because they had 2FA enabled. For them, yeah, it's critical.
Dr. Hax
npub16v…meqha
2026-08-08 21:57:41 UTC
in reply to nevent1q…7urn
Author Public Key
npub16v82nr4xt62nlydtj0mtxr49r6enc5r0sl2f7cq2zwdw7q92j5gs8meqhaSeen on
wss://relay.ditto.pubPublished at
2026-08-08 21:57:41 UTCEvent JSON
{
"id": "f076b092312a0186c94a43687bd45ec1a744d853d76e8a6f4a88a4c10814ad4a",
"pubkey": "d30ea98ea65e953f91ab93f6b30ea51eb33c506f87d49f600a139aef00aa9511",
"created_at": 1786226261,
"kind": 1,
"tags": [
[
"alt",
"A short note: According to the official changelog, it was just a..."
],
[
"e",
"0000b19fb94d23807422896613cf591866d9d6d4ab38f57f89f89533d4ad0086",
"wss://relay.divine.video/",
"root",
"df478568479de26b4a83c1bdc4dbab61b5cc82e1a312e2b28bc815a12a951e67"
],
[
"p",
"50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63",
"wss://relay.snort.social/"
],
[
"p",
"df478568479de26b4a83c1bdc4dbab61b5cc82e1a312e2b28bc815a12a951e67",
"wss://relay.divine.video/"
]
],
"content": "According to the official changelog, it was just a 2FA bug. No risk of loss of funds if you have a strong password.\n\nHaving said that, BTCPay did the right thing by labeling it as a vulnerability, and I'd rather have them inflate its severity than try to downplay it. I wouldn't call it \"critical\", but I have no qualms about our difference of opinion.\n\nBesides, there are probably some people out there who are using admin/password1 and were only not pwned because they had 2FA enabled. For them, yeah, it's critical.",
"sig": "38756499995264766a3207e2d5083bdfa4a600efc6ccde693a1e89ad26cfb8ebeb44728478db39ff0244e8d6d7119a2a00bcb964ff50cea49ab9e96c56f6c687"
}