Alby Hub warns of critical vulnerability in older versions that could lead to fund theft

Alby has confirmed a critical vulnerability in Alby Hub versions v1.7.0 through v1.18.5, where an exposed management API could allow unauthorized access and the transfer of funds. One user has already been affected. Users are advised to restrict public access to the management interface, update to v1.24.0 immediately, and change their unlock passwords. Versions v1.19.0 and higher are not affected, and the latest update also addresses issues reported by Bitcoin Team Red, Project Loupe, and other researchers.