Eclair, ACINQ’s Bitcoin Lightning node software, released version 0.14.4 on October 15 to patch a vulnerability allowing malicious webpages to send authenticated commands to a Lightning node. Exploitation requires an enabled Eclair API reachable from the operator’s browser, with HTTP Basic credentials already cached in that browser. The fix now rejects any request carrying an Origin header with an HTTP 403 response before the API route runs. Legitimate browser interfaces, including those hosted at the same origin as the API, now need an intermediary backend between the browser and Eclair. Command-line access via curl and eclair-cli remains unaffected, and maintainers recommend upgrading without closing existing Lightning channels.
Source: Read the original article
