What happened
ACINQ, the Paris-based team behind the Eclair Lightning implementation, shipped version 0. 13 on Oct. 15 with a security fix that blocks browsers from reaching Eclair's JSON-RPC API directly.
CryptoSlate first flagged the disclosure on Friday, pointing to a cached-authentication route that could have let a crafted webpage issue commands against a running node. The attack path relied on standard browser behavior: once a node operator authenticated to Eclair's API in one tab, the browser cached the HTTP Basic Auth credentials. Any other tab, including a malicious site, could then quietly fire authenticated requests at the local or remote API endpoint.
The 0. 13 release denies cross-origin requests at the server level and documents that any browser-facing dashboard must now talk to a backend service, not Eclair itself.
Why it matters
Eclair is one of three dominant Lightning implementations alongside LND and Core Lightning, and it ships inside ACINQ's Phoenix wallet as well as a long list of self-hosted node setups. An attacker who reached a node's API wouldn't need to steal keys. They could open channels, close them at unfavorable fees, drain balances through outbound payments, or force a force-close cascade that locks funds for days.
The flaw didn't require a sophisticated exploit chain. It required a node operator to visit a webpage. That is a low bar, and the kind of vector that gets weaponized through phishing links aimed at specific operators rather than mass scans.