Alby warns of critical vulnerability in Alby Hub Bitcoin wallets

Alby, a Bitcoin Lightning Network and Nostr tooling company, has disclosed a critical security vulnerability in older versions of Alby Hub. The flaw affects versions v1.7.0 through v1.18.5, which were released prior to August 2025.

The vulnerability specifically impacts instances where the Hub is publicly accessible from the internet. An attacker capable of reaching the Hub’s management API could potentially gain unauthorized access and send funds. Alby reported that, to their knowledge, one user has been impacted by this flaw.

To mitigate risk, Alby advises users running affected versions to immediately restrict public access to the Hub’s management interface. Users are urged to update to the latest release, v1.24.0. Those who were running an affected version while exposed to the internet are also advised to change their unlock passwords after updating. Versions v1.19.0 and newer are unaffected by this specific issue.