LNbits Rotates Authentication Keys in Follow-Up Security Patch

LNbits released version 1.7.1 on Nov. 11, a security patch that rotates authentication keys after a vulnerability put funds on older installations of its Bitcoin Lightning software at risk. The project urged all users to update but did not identify which keys are rotated or say whether the change replaces its earlier recovery steps.

The patch followed version 1.7.0, released Nov. 10. The vulnerability was discovered Nov. 8, affected every version before 1.7.0 and put funds on those installations at risk. Operators had to upgrade before running LNbits again.

Credentials exposed before an upgrade might still let an attacker access an installation afterward. Recovery steps included changing wallet keys and funding-source credentials, replacing other secrets, and rebuilding certain extension connections. Operators who suspect a compromise should move to a fresh server. Version 1.7.1 links to the earlier recovery guidance.

LNbits software runs on top of a Bitcoin (BTC) Lightning funding source and lets operators manage wallets and connected services. LNbits is a hot-wallet system because spending credentials are available to an online service; operators should keep only day-to-day operating funds online.

LNbits creator Ben Arc said the team and users suffered losses but gave no amount. LNbits has not detailed how the vulnerability was exploited and plans to publish a separate report.