Btcpayserver exploit explained:
The old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), Fido2Credentials.Any() was false, so the API accepted username+password and never asked for the TOTP code.
An attacker who obtained your password (reuse, phishing, a leak, brute force) could authenticate straight into Greenfield and skip the second factor entirely, then call spend endpoints.
https://github.com/btcpayserver/btcpayserver/commit/c173a9192d1d4dd1ca837dd906b586af8790632f
utxo the webmaster 🧑💻
npub1ut…r50e8
2026-08-07 21:40:56 UTC
Author Public Key
npub1utx00neqgqln72j22kej3ux7803c2k986henvvha4thuwfkper4s7r50e8Published at
2026-08-07 21:40:56 UTCEvent JSON
{
"id": "0000399f99d20531a87af6bdec6ed99e3d4097eee3d3993f6bd8cba5833a9d8a",
"pubkey": "e2ccf7cf20403f3f2a4a55b328f0de3be38558a7d5f33632fdaaefc726c1c8eb",
"created_at": 1786138856,
"kind": 1,
"tags": [
[
"client",
"Wisp"
],
[
"nonce",
"8756",
"16"
]
],
"content": "Btcpayserver exploit explained:\n\nThe old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), Fido2Credentials.Any() was false, so the API accepted username+password and never asked for the TOTP code. \n\nAn attacker who obtained your password (reuse, phishing, a leak, brute force) could authenticate straight into Greenfield and skip the second factor entirely, then call spend endpoints. \n\nhttps://github.com/btcpayserver/btcpayserver/commit/c173a9192d1d4dd1ca837dd906b586af8790632f",
"sig": "865b3f06a8470bf7c57f6ceb645470ec7d5dfb078a3198e6ee58c80c755759ffa97828a5938641d4e899b3dd58fac8172623abeaecb8eb33d12a9a2a9a6ff41c"
}