CVE-2021-3830: XSS in btcpayserver ≤1.2.3

The XSS vulnerability in btcpayserver allows an attacker to inject arbitrary JavaScript code into web pages served by the application. This code can then be executed in the context of a victim's browser, granting the attacker access to sensitive information such as cookies, session tokens, and other user data. An attacker could also use this vulnerability to redirect users to malicious websites, deface the application, or perform other actions on behalf of the victim. The impact is particularly concerning for btcpayserver deployments handling cryptocurrency transactions, as compromised user accounts could lead to financial losses.

1. Reserved2021-09-26
2. Published2021-09-26
3. Modified2024-08-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2021-3830 is to upgrade btcpayserver to version 1.2.3 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on user-supplied data to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update your btcpayserver configuration to ensure it adheres to security best practices.