Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets

A critical vulnerability in Alby Hub, a self-hosted Lightning wallet, affects versions v1.7.0 through v1.18.5 and could allow attackers to take over internet-exposed wallets and potentially steal funds. The flaw exists when users expose the Hub's management interface to the public internet, contrary to intended deployment on private networks. Alby has confirmed one user was affected, though it is unclear if funds were lost. The company recommends immediately restricting external access and upgrading to version v1.24.0, while also changing the wallet's unlock password if exposed.

AI-extracted · verify before operational use