CVE-2026-119757

CVE-2026-119757 is an information disclosure vulnerability affecting BTCPay Server versions prior to 2.4.2, including its 2.4.2 release candidates. The flaw allows unauthenticated remote attackers to retrieve sensitive `.macaroon` credential files associated with a Lightning Network Daemon (LND) node. These macaroon files act as cryptographic authentication tokens that grant access to the LND node's API. By obtaining these exposed credentials, an attacker can bypass standard security controls and gain administrative control over the affected LND node. This access enables unauthorized operations, such as initiating transactions, closing channels, and moving funds, which can lead to direct theft from affected deployments. To address this vulnerability, users are advised to upgrade to BTCPay Server version 2.4.2 or later and immediately rotate any potentially compromised LND macaroon credentials.