BTCPay Server Released Version 2.4.5
The update strengthens security against Server-Side Request Forgery and adjusts privacy defaults.
Updated on Oct. 6, 2026 in Cybersecurity
Live Poll
Do you find the benefits of regular security software updates worth the effort of reconfiguring settings?
BTCPay Server has released version 2.4.5, an update that introduces critical security measures and restricts permissions for processing refunds. The changes also include a mandatory manual step for operators to re-enable Tor support.
Why it matters
The security update addresses Server-Side Request Forgery vulnerabilities while tightening refund protocols to mitigate insider risks. By reducing the timeframe for public invoice visibility, the platform aims to enhance user privacy and account protection.
The update hides public invoice details one month after issuance and retires support for Bitcoin Plus, Trezarcoin, and JoinMarket. Administrators can now utilize a new command for managing Lightning API routes.
The players
BTCPay Server
This is a free and open-source platform that allows merchants to accept payments in Bitcoin and other cryptocurrencies without a middleman.
GitHub
This is a global software development platform used by developers to host and review code, manage projects, and build software.
The details
Administrators can perform the update via the server settings menu, though they must manually re-enable Tor support after installation. The release also removes integrations for Bitcoin Plus, Trezarcoin, and JoinMarket as part of its streamlined configuration.
Timeline
Version 2.4.2 was released in August 2026.
Version 2.4.4 was released in September 2026.
The 2.4.5 release was announced on October 5, 2026.
The GitHub tag was released on October 6, 2026.
The Tech Race
The update reflects an industry shift toward hardening open-source payment infrastructure against targeted exploitation and unauthorized access. By mandating manual reconfiguration for the Tor anonymity network protocol, the developers are prioritizing explicit security configurations over passive support.
Users will notice that public invoice details automatically disappear one month after issuance, protecting transaction privacy. Additionally, merchants must manually re-enable Tor support in their server settings to maintain previous connectivity configurations.
The takeaway
Operators should prioritize these updates to mitigate risks associated with Server-Side Request Forgery and unauthorized refund attempts. Users are encouraged to audit their server settings immediately to ensure Tor connectivity is restored following the transition.
Further reading
Learn more about securing your infrastructure in the Cybersecurity section.
Source note: This article includes information reported by Crypto Briefing.
Live Poll
Do you find the benefits of regular security software updates worth the effort of reconfiguring settings?
