Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)
What the developer wrote
Authored by Nicolas Dorier
Fix: TOTP 2FA bypass via Greenfield Basic auth (#7491)
What changed, and why it matters
BTCPay Server fixed a bug where accounts protected only by TOTP-based two-factor authentication (the six-digit code from an authenticator app) could log into the Greenfield API using just their email and password, skipping the second factor entirely. The code previously blocked basic login only for users with FIDO2/hardware-key second factors, not for users with app-code (TOTP) second factors. The vendor says this was reported by Ben Carman and shipped as an emergency fix in version 2.4.2.
Upgrade to BTCPay Server 2.4.2 or later. If upgrading is not immediately possible, consider disabling Basic authentication for Greenfield API or requiring API keys instead for TOTP-protected accounts, and review access logs for unexpected Greenfield API use by TOTP-enabled users.
Security signals we found
Authentication bypass of second factor (TOTP 2FA)
Incorrect authorization condition scoped only to FIDO2 credentials
API endpoint (Greenfield) affected by weak single-factor basic auth path
Vendor explicitly labels fix as 'TOTP 2FA bypass'
Emergency release (v2.4.2) includes the fix
Evidence from the diff
BasicAuthenticationHandler.cs previously checked user.Fido2Credentials.Any() to decide whether basic auth should be rejected for MFA-enabled accounts. That condition is true only when FIDO2/WebAuthn credentials are registered, so TOTP-only users were allowed to authenticate via HTTP Basic with email+password alone, bypassing TOTP. The patch replaces the FIDO2-only check with signInManager.IsTwoFactorEnabledAsync(user), which catches any enabled 2FA method, including TOTP. The change is a single-line guard broadening the rejection condition.
Changed components
BTCPayServer/Security/GreenField/BasicAuthenticationHandler.csGreenfield API basic authentication flowTOTP two-factor authentication enforcementInspect captured patch +1 / −1
diff --git a/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs b/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
index ac4ed6b..b5bbddd 100644
--- a/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
+++ b/BTCPayServer/Security/GreenField/BasicAuthenticationHandler.cs
@@ -75,7 +75,7 @@ namespace BTCPayServer.Security.Greenfield
}
if (user is null)
return Fail($"Basic authentication failed");
- if (user.Fido2Credentials.Any())
+ if (await signInManager.IsTwoFactorEnabledAsync(user))
{
return Fail("Cannot use Basic authentication when multi-factor is enabled.");
}
Why this scored 78/100
Evidence and disclosure record
Verified links used to place this patch in context. External claims remain attributed to their publishers.
Fix: TOTP 2FA bypass via Greenfield Basic auth
Vendor-authored fix and disclosure explaining that TOTP-only accounts could access the Greenfield API with only an email and password, bypassing the second authentication factor. The report is credited to Ben Carman.
BTCPay Server 2.4.2
The emergency release also ships this TOTP-bypass fix. BTCPay's separate incident advisory describes an actively exploited unauthenticated file-access flaw affecting LND credentials; it does not identify this TOTP bypass as that flaw.
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.