Vendor
BTCPay Server versions prior to 2.4.2 are vulnerable to an unauthenticated information disclosure flaw allowing remote attackers to steal LND node macaroon files for full administrative control and fund theft.