ECLAIR’S BROWSER FIX SAT PUBLIC FOR 30 DAYS — ITS API TAKES A BITCOIN ADDRESS AND AN AMOUNT AS PLAIN FORM FIELDS

On Oct. 15, 2026, ACINQ shipped Eclair v0.14.4, a patch release for its Lightning node software. The main change: the node’s API now refuses any request that carries an Origin header. Web browsers send that header. The curl tool and eclair-cli do not. So the API can no longer be called from a browser at all, even from the same site.

The reason is in ACINQ’s release notes. The API uses HTTP basic authentication, and browsers attach saved credentials to cross-site requests. Once that happens, the notes say, “any web page the node operator visits could then forge authenticated API calls,” and “a plain HTML form is enough.” The page cannot see the answer, “but the API call has already been made.” One of those calls, in Eclair’s own code, is sendonchain. It takes a bitcoin address and an amount in satoshis as form fields. The notes do not name it, and nobody has reported a loss.

There are limits. The API is off by default, and when on it listens only on 127.0.0.1, the machine itself. That is less of a wall than it sounds when the browser runs on the same machine, because here the browser is the one making the call. The fix checks only whether the header is present. The pull request is plain about it: “This is a defence against browser CSRF, not an authentication mechanism.”

The fix merged on GitHub on Sept. 15, 2026, the day after v0.14.3 shipped. The release that carried it came 30 days later. For a month the change was public and no tagged release had it. ACINQ says to upgrade, and channels stay open through it. A node’s keys are only as safe as the last web page its owner opened with the password saved. At the time of this writing, bitcoin was $81,417.