LNbits releases a second security patch; operators still need credential recovery steps

LNbits published version 1.7.1 on 11 November at 14:21 UTC, marking it as an immediate security update that rotates authentication keys. It follows the urgent 1.7.0 release. The project's recovery guidance warns that updating alone may leave access gained during an earlier compromise intact.

The operator guidance concerns a vulnerability discovered on 8 November. It tells administrators to replace user wallet keys, funding-source credentials and other sensitive settings, and to review connected applications. Suspected compromises warrant a fresh server while preserving relevant logs and records. The latest release links back to those instructions, so the recovery work remains relevant after installing the newer patch.

Changing keys also affects legitimate integrations: connected applications need replacement credentials once the old ones stop working. Users of a hosted LNbits instance should obtain guidance from its operator rather than assume their service has upgraded. LNbits describes itself as a hot-wallet system and advises limiting online funds to operational needs. No total loss figure or completed-recovery claim is established by these release notes; a fuller exploit report remains promised.