BTCPay’s API key fix is merged, but its latest release still predates the patch
Photo: CryptoSlate
BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended. Nicolas Dorier merged PR #7684 into the project's master development branch. As of Oct. 26, BTCPay's release list still identifies version 2.4.5 , dated Oct. 6, as its latest release. BTCPay's authentication documentation describes API keys as integration credentials restricted by permission and store.
Also reported by The Currency Analytics.
Source: CryptoSlate
