Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)
What the developer wrote
Authored by Nicolas Dorier
Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)
What changed, and why it matters
BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (2FA) could access the Greenfield API using just an email and password, skipping the second factor. The change now blocks Basic authentication for any account that has any form of 2FA enabled, not just those using FIDO2 security keys. The vendor calls this a critical vulnerability under active exploitation and urges immediate upgrades.
Upgrade to BTCPay Server 2.4.2 or later immediately. If upgrading is not immediately possible, restrict access to the Greenfield API and monitor for unauthorized API access from accounts with TOTP 2FA enabled.
Security signals we found
2FA bypass
authentication logic flaw
TOTP bypass
Basic authentication weakness
vendor-reported active exploitation
critical severity per vendor release notes
Evidence from the diff
The BasicAuthenticationHandler previously rejected Basic auth only when the user had FIDO2 credentials (user.Fido2Credentials.Any()). This left TOTP-only 2FA accounts able to authenticate to the Greenfield API with username/password alone, bypassing the TOTP requirement. The patch replaces that check with signInManager.IsTwoFactorEnabledAsync(user), which returns true for any enabled 2FA method, including TOTP. The diff is a single-line change in BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs.
Changed components
BTCPayServer/Security/GreenField/BasicAuthenticationHandler.csGreenfield API Basic authentication flowTOTP 2FA-protected accountsInspect captured patch +1 / −1
diff --git a/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs b/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
index ac4ed6b..b5bbddd 100644
--- a/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
+++ b/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
@@ -75,7 +75,7 @@ namespace BTCPayServer.Security.Greenfield
}
if (user is null)
return Fail($"Basic authentication failed");
- if (user.Fido2Credentials.Any())
+ if (await signInManager.IsTwoFactorEnabledAsync(user))
{
return Fail("Cannot use Basic authentication when multi-factor is enabled.");
}
Why this scored 86/100
Evidence and disclosure record
Verified links used to place this patch in context. External claims remain attributed to their publishers.
Fix: TOTP 2FA bypass via Greenfield Basic auth
Vendor-authored fix and disclosure explaining that TOTP-only accounts could access the Greenfield API with only an email and password, bypassing the second authentication factor. The report is credited to Ben Carman.
BTCPay Server 2.4.2
Vendor release notes identify this as a critical vulnerability under active exploitation, urge immediate upgrades, and credit Bruno Garcia and Ben Carman through the Bitcoin Red Team effort.
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.