Bitcoin Lightning wallet Alby finds critical flaw in older Alby Hub versions

Bitcoin Lightning wallet Alby said a critical vulnerability was found in Alby Hub versions v1.7.0 through v1.18.5 that could allow unauthorized fund transfers. If users ran those versions with external internet access enabled, attackers could access the admin API and transfer funds without authorization. Alby said it has identified one affected user so far. Alby urged users on those versions to block external access to the admin interface and immediately update to the latest version, v1.24.0. Users who operated vulnerable versions with external access should also change their unlock password after updating. Versions v1.19.0 and later, released on Aug. 29, 2025, are not affected by the vulnerability.