Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
Alby warns a critical flaw in internet-exposed Alby Hub Bitcoin wallets (v1.7.0–v1.18.5) could allow takeover and fund theft; update to v1.24.0.
Alby disclosed a critical flaw in Alby Hub, its self-hosted Lightning wallet, affecting versions v1.7.0 through v1.18.5 when the management interface is reachable from the internet. The flaw could let attackers take over a wallet and send its funds; one affected user has been reported so far, with no word on losses. Versions v1.19.0 and later contain the fix, and Alby advises updating to v1.24.0, binding port 8080 to localhost or firewalled sources, and changing unlock passwords on previously exposed hubs. Full technical details will be published later under responsible disclosure.
45