Eclair patches browser attack that could hit Lightning nodes
An Oct. 15 Eclair release closes a route that let a web page abuse cached authentication to reach the node's API.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Eclair shipped a fix on Oct. 15 for a browser-based attack route to its API.
- The hole involved cached authentication being reused to reach the node's API.
- Browser interfaces that talk to Eclair directly must now add a backend.
- Node operators running Eclair should check they're on the latest release.
Eclair, a Lightning Network node implementation, has patched a flaw that could let a browser-based attack push commands to a node's API. The fix shipped in a release on Oct. 15.
What changed
The release blocks a route that depended on cached authentication. Here's the mechanism: a browser holding saved credentials could serve as the path into the node's API. The patch closes it.
A second change matters if you build on Eclair. Interfaces that run in the browser and talk straight to Eclair's API now need a backend in between. The direct connection is gone.
What we don't know
The source material doesn't say whether anyone exploited the issue, or how many nodes ran exposed setups. I won't guess. Eclair's release notes are the place to look for specifics.
Why it matters
Lightning nodes hold live funds in channels, so an API that accepts commands is a serious target. Running Eclair? Update. Built a dashboard or wallet front end that calls the node directly from the browser? Expect it to break until you add a backend, and read that as a feature, not a nuisance. The open question is how many other node tools still lean on the same shortcut.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇨🇦 Showing sites that accept players from Canada Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-facing book that pays a premium for crypto deposits: 125% against 100% for cash, with fee-free deposits across five coins.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
More info Less info
Why we chose it: Phemex is a derivatives-first venue for Europe, Asia and Latin America. Good engine, mid-size liquidity, and a blocklist that grew in 2025.
- Online since
- 2019
- Licence
- Seychelles
- KYC
- Required
Restricted countries: United Arab Emirates, Afghanistan, Australia, Belgium, Bermuda, Belarus, Ontario (Canada), China and 18 more.
More info Less info
Why we chose it: BetNow's casino floor with the biggest match bonus we list. The 200% headline deserves a careful read of the code terms behind it.
- Payout time
- Within 24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Afghanistan, Bulgaria, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau and 16 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
