What the developer wrote
Authored by Nicolas Dorier
Changelog for 2.4.2
What changed, and why it matters
This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authentication bypass when using Greenfield Basic authentication. The actual code fixes are not shown in this commit, so we can only see the vendor's description of the issues. The vendor rates these as 'not critical' but still recommends updating.
Update to BTCPay Server 2.4.2 and NBXplorer 2.6.10 as recommended by the vendor. Review whether any integrations rely on Greenfield Basic authentication, since it is now disabled by default five minutes after account creation. If Basic auth is required, re-enable it through account settings or the API.
Security signals we found
Vendor describes security fixes in changelog
TOTP two-factor authentication bypass via Greenfield Basic authentication
Basic authentication disabled by default after account creation
Public invoice creation rate-limited
Security issues reported by external Bitcoin Red Team researchers
Evidence from the diff
The diff only updates Build/Version.csproj from 2.4.1 to 2.4.2 and adds a Changelog.md entry for 2.4.2. The changelog mentions security fixes: (1) Greenfield Basic auth is disabled by default five minutes after account creation, with opt-in; (2) a TOTP 2FA bypass via Greenfield Basic authentication was fixed. It also mentions rate limiting on public invoice creation. The actual patches for these fixes are in other commits not supplied here, so this commit itself contains no code changes that can be directly analyzed for vulnerability details.
Changed components
BTCPay Server Greenfield API authenticationTOTP two-factor authentication flowBasic authentication mechanismPayment Requests / public invoice creationInspect captured patch +29 / −1
diff --git a/Build/Version.csproj b/Build/Version.csproj
index 583bb85..abb06df 100644
--- a/Build/Version.csproj
+++ b/Build/Version.csproj
@@ -1,5 +1,5 @@
<Project>
<PropertyGroup>
- <Version>2.4.1</Version>
+ <Version>2.4.2</Version>
</PropertyGroup>
</Project>
diff --git a/Changelog.md b/Changelog.md
index 8fa2ae5..686869d 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,5 +1,33 @@
# Changelog
+## 2.4.2
+
+Although these security fixes are not critical, we recommend updating at your earliest convenience.
+We recommend integrators to also update NBXplorer to version 2.6.10.
+
+Those have been reported to us by @brunoerg and @benthecarman from the Bitcoin Red Team effort.
+
+### Breaking change
+
+* Greenfield: Disable Basic authentication by default five minutes after account creation, with opt-in available through account settings and the API (#7492) @NicolasDorier
+
+We are not aware of any user impacted by this breaking change, as API Keys authentication is generally used.
+
+### New features
+
+* Wallet: Allow hiding, showing, and reordering transaction table columns (#7474) @dstrukt
+
+### Fixes
+
+* Wallet: Improve multisig PSBT signing and finalization reliability, including compatibility with newer HWI and Jade firmware versions (#7484 #7488) @rockstardev
+* Fix RTL stylesheets not loading correctly (#7482) @teamssUTXO
+* Fix TOTP two-factor authentication bypass via Greenfield Basic authentication (#7491) @NicolasDorier
+
+### Improvements
+
+* Improve the layout and readability of store settings pages (#7448) @dstrukt
+* Payment Requests: Rate limit public invoice creation @NicolasDorier
+
## 2.4.1
### New features
Why this scored 64/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.