Btcpayserver exploit explained:
The old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), Fido2Credentials.Any() was false, so the API accepted username+password and never asked for the TOTP code.
An attacker who obtained your password (reuse, phishing, a leak, brute force) could authenticate straight into Greenfield and skip the second factor entirely, then call spend endpoints.
https://github.com/btcpayserver/btcpayserver/commit/c173a9192d1d4dd1ca837dd906b586af8790632f
The old check only refused Basic auth if the user had FIDO2 credentials (a hardware security key). If you secured your account with TOTP (Google Authenticator etc.), Fido2Credentials.Any() was false, so the API accepted username+password and never asked for the TOTP code.
An attacker who obtained your password (reuse, phishing, a leak, brute force) could authenticate straight into Greenfield and skip the second factor entirely, then call spend endpoints.
https://github.com/btcpayserver/btcpayserver/commit/c173a9192d1d4dd1ca837dd906b586af8790632f
104❤️3👍2♥️1🤙1
