Full Report
Bitcoin wallet company Alby has warned of a critical flaw in Alby Hub that could have let an attacker take over a wallet and send its funds, but only where the owner had made the Hub reachable from the internet. Alby Hub is a self-hosted Lightning wallet, meaning the owner runs it on their own computer or server, and it holds their bitcoin. The flaw affects versions v1.7.0 through
Analysis Summary
# Vulnerability: Alby Hub Critical Remote Wallet Takeover Flaw
## CVE Details
- **CVE ID**: Not yet assigned (Pending full disclosure)
- **CVSS Score**: Not explicitly stated; characterized as **Critical**
- **CWE**: Likely related to CWE-287 (Improper Authentication) or CWE-668 (Exposure of Resource to Wrong Sphere) based on description.
## Affected Systems
- **Products**: Alby Hub (Self-hosted Bitcoin Lightning wallet)
- **Versions**: v1.7.0 through v1.18.5
- **Configurations**: Hubs configured to be reachable from the public internet (exposed management interface).
## Vulnerability Description
The flaw allows a remote attacker to bypass security measures to take over an Alby Hub wallet and drain its funds. While specific technical details are currently withheld by the vendor for responsible disclosure, the vulnerability is exacerbated by a configuration issue where the Hub's server listens on all network interfaces (0.0.0.0) by default, rather than just localhost (127.0.0.1), potentially exposing the management web interface to the public web.
## Exploitation
- **Status**: Exploited in the wild (at least one confirmed user affected)
- **Complexity**: Low (if the Hub is internet-exposed)
- **Attack Vector**: Network
## Impact
- **Confidentiality**: High (Access to wallet management and history)
- **Integrity**: High (Ability to send funds and modify wallet settings)
- **Availability**: High (Total loss of funds/control over the wallet)
## Remediation
### Patches
- **Update to v1.24.0 (Current Release)**: Alby recommends all users update immediately.
- The fix was originally introduced in **v1.19.0** (released August 29, 2025).
### Workarounds
- **Disable Public Access**: Stop the Hub from being reachable outside your local network.
- **Docker Users**: Change port publishing from `8080:8080` to `127.0.0.1:8080:8080`.
- **Cloud/VPS Users**: Update firewall rules (Security Groups) to restrict port 8080 access to your specific IP address only, or close the port and use a secure VPN/SSH tunnel.
## Detection
- **Indicators of Compromise**: Unauthorized outgoing Bitcoin Lightning transactions; unexpected changes to the unlock password.
- **Detection Methods**: Review server logs for unauthorized IP addresses accessing the management interface on port 8080. Check version status via the Hub dashboard.
- **Post-Exploit Action**: If you were running an affected version exposed to the internet, **change your unlock password** immediately after updating and contact `security[at]getalby.com`.
## References
- **Vendor Advisory (X/Twitter)**: hxxps[://]x[.]com/getAlby/status/2097574956049498150
- **GitHub Release Page**: hxxps[://]github[.]com/getAlby/hub/releases
- **GitHub Documentation Fix**: hxxps[://]github[.]com/getAlby/hub/pull/2580
- **Original Report**: hxxps[://]thehackernews[.]com/2026/09/alby-hub-critical-flaw-could-let.html