btcpayserver — Vulnerabilities & Security Advisories 9

BTCPay Server is an open-source payment processor enabling businesses to accept Bitcoin and other cryptocurrencies without third-party intermediaries. Historically, it has been susceptible to multiple vulnerability classes including cross-site scripting (XSS), remote code execution (RCE), and privilege escalation, with nine CVEs documented to date. Notable security characteristics include its self-hosted nature reducing dependency risks, though past incidents have exposed flaws in default configurations and third-party integrations. The platform's decentralized architecture contrasts with traditional payment systems but introduces unique security challenges in securing node infrastructure and managing cryptographic keys.