← Editorial Bitcoin

Security Flaw in Alby Hub Software Prompts Critical Update for Bitcoin Lightning Nodes

Operators of self-hosted Alby Hub Bitcoin Lightning nodes have been urged to update after a critical vulnerability was disclosed in older software versions.

· -3

A critical vulnerability has been identified in older releases of Alby Hub, a self-hosted software package used to operate nodes on the Bitcoin Lightning Network. The issue affects versions v1.7.0 through v1.18.5, which were released before August 2025, and allows an attacker to gain unauthorized access and drain funds if the management interface is directly reachable over the public internet.

The developer has urged node operators running vulnerable installations to restrict public internet access to the admin panel, upgrade to version v1.24.0, and change their unlock passwords. The underlying flaw was resolved starting with the v1.19 release series, and the provider's hosted service remains unaffected.

Unlike standard mobile wallet applications that rely on third-party infrastructure, Alby Hub runs continuously on local hardware or dedicated servers to keep Lightning payment channels open and forward transactions. Reports indicate that exactly one user has been confirmed affected by the vulnerability, while formal CVE documentation had not been published at the time of reporting.

How this piece reads Sell tone -3
Site call on Bitcoin Neutral score 5.6

These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.

More on Bitcoin All pieces →

Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.