https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 05:35:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-62253 <p>Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == &#34;&#34;`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.</p> <p>Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == &#34;&#34;`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-62253 https://vulnerability.circl.lu/vuln/ghsa-rqcc-94gv-wjm9 <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary Both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == &#34;&#34;`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated.</p> <p>### Details **`coordinator/handlers/auth.go` lines 298-304:** ```go func (h *Auth) JWTMiddleware() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == &#34;&#34; { return next(c) // bypass — no validation performed } ```</p> <p>**`coordinator/handlers/auth_v4_helpers.go` lines 177-182:** ```go func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == &#34;&#34; { return next(c) // same bypass ```</p> <p>**`coordinator/coordinator.go` lines 315-317:** ```go if c.config.JWT.Secret != &#34;&#34; { protected.Use(authHandler.JWTMiddleware()) // middleware not even registered when secret is empty } ```</p> <p>**`config/config.go` line 845:** `Secret` field struct tag has `default:&#34;&#34;`. The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.</p> <p>### PoC ```bash # On a default Homer installation (no JWT secret configured), all protected routes are open: curl http://&lt;homer-host&gt;/api/v3/user…</p> <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary Both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == &#34;&#34;`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated.</p> <p>### Details **`coordinator/handlers/auth.go` lines 298-304:** ```go func (h *Auth) JWTMiddleware() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == &#34;&#34; { return next(c) // bypass — no validation performed } ```</p> <p>**`coordinator/handlers/auth_v4_helpers.go` lines 177-182:** ```go func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == &#34;&#34; { return next(c) // same bypass ```</p> <p>**`coordinator/coordinator.go` lines 315-317:** ```go if c.config.JWT.Secret != &#34;&#34; { protected.Use(authHandler.JWTMiddleware()) // middleware not even registered when secret is empty } ```</p> <p>**`config/config.go` line 845:** `Secret` field struct tag has `default:&#34;&#34;`. The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.</p> <p>### PoC ```bash # On a default Homer installation (no JWT secret configured), all protected routes are open: curl http://&lt;homer-host&gt;/api/v3/user…</p> https://vulnerability.circl.lu/vuln/ghsa-rqcc-94gv-wjm9