BTCPay’s API key fix is merged, but its latest release still predates the patch

BTCPay Server, software for accepting Bitcoin payments, merged a fix on Oct. 19 for a gap that could let API keys with broad permissions for one store reach server-wide or account-wide functions. For merchants sharing such credentials with an integration, the risk is delegating more authority than intended. Nicolas Dorier merged PR #7684 into the project's master development branch. As of Oct. 26, BTCPay's release list still identifies version 2.4.5 , dated Oct. 6, as its latest release. BTCPay's authentication documentation describes API keys as integration credentials restricted by permission and store. Those are separate limits: what an application may do, and which store it may act on.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CryptoSlate.