Affected Systems
Alby Hub versions v1.7.0 through v1.18.5 (all releases before August 2025). Only instances exposed to the internet are vulnerable. Versions v1.19.0 and later are patched. Current version is v1.24.0.
Exploitation Status
Confirmed exploitation. One user has been affected. Alby has not disclosed whether funds were stolen. Technical details of the vulnerability have not been published yet per responsible disclosure practices.
Business Impact
Attackers can take over self-hosted Lightning wallets and steal bitcoin funds from internet-exposed Alby Hub instances. The vulnerability only affects Hubs made reachable from the public internet, not those on private networks. Alby's setup documentation previously did not adequately warn against internet exposure, and some official cloud deployment guides described configurations that left port 8080 publicly accessible. No CVE assigned. Severity is critical due to direct financial loss potential.
Urgency
🔴 Immediate
Recommended Actions
- Immediately identify all Alby Hub instances running versions v1.7.0 through v1.18.5 in your environment
- Block external access to Alby Hub management interface (port 8080) before updating: in Docker use 127.0.0.1:8080:8080 binding, on cloud servers restrict firewall rules to trusted IPs only
- Update all instances to v1.24.0 (current release) even if not previously internet-exposed
- For any Hub that ran affected versions while internet-exposed: change the unlock password immediately after update and contact security@getalby.com
- Review firewall rules and reverse proxy configurations to ensure no Lightning wallet management interfaces are publicly accessible