We have confirmed a critical vulnerability in Alby Hub v1.7....

captjack 🏴‍☠️✨💜

npub1te0uzs6vj29umjaxlqqct82j8q6ppyefrxq06dhr8d6pvwfatgkqjmjgwp

hex

f6ceb2d931b3573153e509fd7b02a49c2d81c69be58208726983963ab33f508e

nevent

nevent1qqs0dn4jmycmx4e320jsnltmq2jfctvpc6d7tqsgwf5c8936kvl4prsprpmhxue69uhhyetvv9ujuem4d36kwatvw5hx6mm9qgs9uh7pgdxf9z7dewn0sqv9n4frsdqsjv53nq8axm3nkaqk8y745tq429uxc

Kind-1 (TextNote)

2026-09-09T08:48:04Z

↳ Reply to Manánguri (npub1gxqd5cu2y4uu2xrmuhfp98xjl546vfz23705mkvsj26ys7euz3lqncwdkf)

What happened to Alby?

We have confirmed a critical vulnerability in Alby Hub v1.7.0–v1.18.5 (releases prior to August 2025) when the Hub is publicly accessible from the internet. The vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds.

Alby Hub v1.19.0 (released Aug 29, 2025) or newer are unaffected.

Raw JSON

{
  "kind": 1,
  "id": "f6ceb2d931b3573153e509fd7b02a49c2d81c69be58208726983963ab33f508e",
  "pubkey": "5e5fc1434c928bcdcba6f801859d5238341093291980fd36e33b7416393d5a2c",
  "created_at": 1788943684,
  "tags": [
    [
      "e",
      "b72159fdb40da17a1df180fa09bbdcfe0de25ddf43bc781421c648718def2a3f",
      "wss://nostr.superfriends.online/",
      "root",
      "5e5fc1434c928bcdcba6f801859d5238341093291980fd36e33b7416393d5a2c"
    ],
    [
      "e",
      "7b0dabe9f82996ebeed954713831b28702c1bf1cf184960523948b7ddc7aed28",
      "wss://nostr.superfriends.online/",
      "reply",
      "4180da638a2579c5187be5d2129cd2fd2ba6244a8f9f4dd99092b4487b3c147e"
    ],
    [
      "p",
      "4180da638a2579c5187be5d2129cd2fd2ba6244a8f9f4dd99092b4487b3c147e"
    ]
  ],
  "content": "We have confirmed a critical vulnerability in Alby Hub v1.7.0–v1.18.5 (releases prior to August 2025) when the Hub is publicly accessible from the internet. The vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds.\n\nAlby Hub v1.19.0 (released Aug 29, 2025) or newer are unaffected.",
  "sig": "1c3b869fe8a0b467f063479c4cf1e1c0e03ca051b1a40dc41669960e309d40a1413cd6166c32262c6e75a2a1217c058c1d002273f603274c468f5bc3667a5741"
}