BTCPAY SERVER 2.4.6 SHIPS THE STORE-KEY FIX — A LINK NO LONGER DECIDES WHEN A SEED-SIGNED TRANSACTION GOES OUT — NO ADVISORY, NO CVE, NO BLOG POST

BTCPay Server released version 2.4.6 at 14:25 UTC on October 26, 2026. It ships the fix this desk wrote up on October 23, when it was merged but in no release: pull request #7684, which keeps an API key limited to one store inside that store, even when the key’s owner is a server admin. The fix sat in the code seven days before a release carried it.

The same release changes how signing works from a link. Pull request #7713, merged October 22, says seed-signing pages opened from a link “now ignore pending-transaction and payjoin workflow state supplied through the URL. After signing, the signer returns to the decoded transaction review instead of the link deciding that the signature should be collected or broadcast immediately.” Other fixes in it stop a manager of one store from removing another store’s payout processor (#7722) and stop outside web pages from firing admin actions in a logged-in browser (#7658, #7659).

Look at how it was told. The notes open with “broad security hardening” and list 20 pull requests on a single line. They thank three people “for responsibly disclosing security issues fixed in this release.” There’s no CVE, no GitHub security advisory, and at 16:40 UTC no blog post. Compare August 7, when BTCPay’s blog told LND users to “update to version 2.4.2 now” and said “Users were affected and funds were stolen.”

BTCPay is self-hosted, so nobody patches it for you. Here the changelog is the advisory, and a merchant with a hot wallet on the server has to read it line by line to know what changed. Nothing in the release says any of these flaws was used against anyone. At the time of this writing, bitcoin was $80,034.