CVE-2022-32984

CVE-2022-32984 is a sensitive information disclosure vulnerability affecting BTCPay Server versions 1.3.0 through 1.5.3. A remote attacker can obtain the store's xpub and, if not using the internal lightning node, lightning node credentials from the HTML source of a publicly exposed Point of Sale app. This vulnerability has a CVSS score of 7.5 (High) due to its network attack vector, low complexity, and high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion, with only one article mentioning it.