Alby Confirms Critical Vulnerability in Hub v1.7.0 to v1.18.5

Alby confirmed a critical vulnerability in Alby Hub v1.7.0 to v1.18.5 that could allow unauthorized access and fund transfers if the management API is exposed to the public internet. According to ChainCatcher, one user is known to have been affected, while Alby Hub v1.19.0 and later versions are not impacted. Alby advised affected users to restrict public access to the management interface, update immediately to v1.24.0, and change the unlock password after updating. The latest version also fixes multiple issues reported by Bitcoin Team Red, Project Loupe, and other researchers.