The BTCPay Server team has issued version 2.4.7, an emergency bug-fix release addressing 85 security, reliability, and accounting issues identified during an open-source security audit. The patched findings include 1 Critical, 13 High, 52 Medium, and 19 Low severity vulnerabilities; specific details regarding the Critical and High findings remain undisclosed.

Key addressed issues include:

• Authorization & Store Isolation: Fixed cross-store data leakage across search, forms, notifications, and Greenfield listings; resolved a flaw allowing canceled payouts to be reopened while bypassing pull-payment limits.
• API & Authentication Hardening: BitPay API invoices now enforce confirmation policies and expiration limits; retrieving individual invoices now requires authentication, and passed tokens are validated against the authenticated user.
• Session & Auth Controls: Enforced stricter rate limiting on parallel 2FA attempts; set LNURL-auth challenges to expire after five minutes and invalidate upon credential changes.
• Wallet Integrity: Added verification to ensure cached addresses belong to the active wallet following wallet replacements, deletions, or multisig reconfigurations.
• Breaking Change: Deprecated /invoices/create legacy endpoints were removed in favor of /stores/{storeId}/invoices/create.