EUVD-2026-94523
GHSA-rqcc-94gv-wjm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Homer coordinator API over network
-
DeliverySend unauthenticated GET /api/v3/databases
-
ExploitJWT middleware bypassed (empty secret)
-
ExecutionRead users and DB credentials
-
PersistPOST /api/v3/users to create admin
-
ImpactFull read/write of config and VoIP data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable when coordinator.jwt.secret is left at its Go struct default of empty string - i.e. a default installation where the operator did not explicitly set a JWT secret (the shipped example config contains only a placeholder, so config-file-driven installs may or may not be affected depending on whether that placeholder is applied). Under this condition the JWTMiddleware/JWTMiddlewareV4 functions return next(c) with no validation and the middleware is not even registered, exposing all /api/v1, /api/v3, and /api/v4 admin endpoints to remote unauthenticated requests. The only limiting factors are deployment-side: the coordinator API must be network-reachable by the attacker, and operators who set a non-empty strong secret are fully protected. No user interaction, credentials, or non-default feature toggles are required on an affected instance. |
| Impact | All signals align toward genuine high priority for exposed instances. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) is internally consistent with the description: on a default Homer install the JWT secret is empty, so both JWTMiddleware and JWTMiddlewareV4 short-circuit and protected /api/v1, /api/v3, /api/v4 routes are served with no authentication - a textbook CWE-306. PR:N is well-justified here because the unauthenticated state is the DEFAULT, not a misconfiguration the attacker must engineer. A working PoC (unauthenticated curl against /api/v3/users and /api/v3/databases, plus admin-user creation) is published in the GHSA advisory, so publicly available exploit code exists. No EPSS score and no KEV status were provided in the input, so real-world exploitation frequency cannot be quantified from this data; absence of KEV is NOT evidence of non-exploitation, only that CISA has not listed it. The main factor that could downgrade real risk is exposure: impact requires that the Homer coordinator API be network-reachable by the attacker and that the operator left the secret empty - the example config ships a placeholder, so operators who copied it may be unaffected. For any default or internet-exposed deployment this is a real, trivially exploitable critical issue; for hardened deployments with an explicit secret it is not exploitable at all. |
| Exploit ScenarioDerived | An attacker who can reach the Homer coordinator API over the network sends a plain unauthenticated HTTP request (e.g. GET /api/v3/databases) and immediately receives all stored database connection strings and user records. Because the same bypass covers write endpoints, they then POST to /api/v3/users to create an admin account, gaining full control over configuration, users, and captured VoIP call data. A public PoC exists in the vendor advisory, and the low attack complexity (AC:L) means no special timing or conditions are needed beyond network reachability of a default-configured instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Missing authentication in the HOMER (sipcapture Homer) coordinator allows remote unauthenticated attackers to fully control the administrative API whenever the JWT signing secret is left at its default empty value. Because JWTMiddleware and JWTMiddlewareV4 both short-circuit with next(c) when the secret is empty - and the middleware is not even registered on the protected route groups in that state - every endpoint under /api/v1, /api/v3 and /api/v4 is reachable without credentials, permitting reads and writes of users, configuration, database connection strings and stored VoIP call data, including creation of a new admin user. The flaw carries a 9.8 CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) under CWE-306, is unauthenticated by vector, and a vendor fix is available per the advisory; exploitation status is no public exploit identified at time of analysis, though the vendor advisory itself contains curl-based reproduction steps.
RemediationAI
Vendor-released patch: upgrade to Homer release 11.0.283 or later, or apply PR https://github.com/sipcapture/homer/pull/839 (commit https://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b, Go module fixed version 0.0.0-20260625093330-5e90809657c9). The patch makes the coordinator fail closed: if coordinator.jwt.secret is empty it generates a random 32-byte secret, persists it as .homer_jwt_secret (0600) beside settings_db_path, and always registers JWTMiddleware/JWTMiddlewareV4; the middleware itself now returns HTTP 500 instead of bypassing validation. Immediately after upgrading, or as a hardening measure on any build, explicitly set coordinator.jwt.secret (minimum 32 characters, via config or HOMER_COORDINATOR_JWT_SECRET) - this is required for multi-host deployments because an auto-generated secret file is local to each node and will otherwise break cross-node token validation, and rotating the secret invalidates existing sessions/tokens. Until patching is possible, the only effective compensating control is to remove network exposure: bind the coordinator API to localhost or a management-only interface and block /api/v1, /api/v3 and /api/v4 from untrusted networks with firewall or reverse-proxy rules (deny-by-default), accepting that any host able to reach the port retains full administrative access; applying an authenticating reverse proxy in front of the API is a workaround but does not fix the underlying bypass if the coordinator port remains directly reachable. Assume any internet- or broadly reachable instance running with an empty secret has already been read from and potentially had rogue admin users or configuration changes injected, and audit users, configuration and database connection settings accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Homer's coordinator is a Go service built on the Echo web framework, and access control is implemented as Echo middleware wrapping protected route groups. The affected code lives in coordinator/handlers/auth.go (JWTMiddleware) and coordinator/handlers/auth_v4_helpers.go (JWTMiddlewareV4): in both, an empty h.jwtSecret causes an immediate 'return next(c)', skipping all token validation. Compounding this, coordinator/coordinator.go only calls protected.Use(...) when c.config.JWT.Secret != "", so on the default configuration the middleware is never attached at all. The root cause class is CWE-306 (Missing Authentication for Critical Function) - the application fails open on an unconfigured security control rather than failing closed. The configuration default originates in config/config.go, where the JWT Secret struct tag is default:"", meaning installations that do not supply an explicit value end up with an empty signing secret; the package identifier in the affected-products data is pkg:go/github.com_sipcapture_homer-app, and the GitHub advisory (GHSA-rqcc-94gv-wjm9) maps the flaw to the Go module github.com/sipcapture/homer-app. The fix introduces a coordinator/services/jwt_secret.go helper (ResolveCoordinatorJWTSecret) that generates a 32-byte random secret, base64url-encodes it, persists it as .homer_jwt_secret (mode 0600) alongside settings_db_path, and unconditionally registers the JWT middleware, while the middleware itself now returns HTTP 500 ('JWT authentication is not configured') instead of passing the request through.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default empty secret makes protected API remotely reachable with no credentials (AV:N/PR:N/UI:N/AC:L); full read/write of users, DB creds, and call data gives C:H/I:H/A:H.
Primary rating from Vendor (https://github.com/sipcapture/homer).
CVSS VectorVendor: https://github.com/sipcapture/homer
DescriptionCVE.org
Summary
Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated.
Details
coordinator/handlers/auth.go lines 298-304:
func (h *Auth) JWTMiddleware() echo.MiddlewareFunc {
return func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error {
if h.jwtSecret == "" {
return next(c) // bypass - no validation performed
}coordinator/handlers/auth_v4_helpers.go lines 177-182:
func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc {
return func(next echo.HandlerFunc) echo.HandlerFunc {
return func(c echo.Context) error {
if h.jwtSecret == "" {
return next(c) // same bypasscoordinator/coordinator.go lines 315-317:
if c.config.JWT.Secret != "" {
protected.Use(authHandler.JWTMiddleware()) // middleware not even registered when secret is empty
}config/config.go line 845: Secret field struct tag has default:"". The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty.
PoC
# On a default Homer installation (no JWT secret configured), all protected routes are open:
curl http://<homer-host>/api/v3/users
# Returns full user list with no credentials
curl http://<homer-host>/api/v3/databases
# Returns all database connection strings
curl -X POST http://<homer-host>/api/v3/users \
-H 'Content-Type: application/json' \
-d '{"username":"attacker","password":"pw","partid":10,"usergroup":"admin"}'
# Creates a new admin user with no credentialsImpact
Missing Authentication for Critical Function (CWE-306). On a default Homer installation with no JWT secret configured, every admin API endpoint is completely unauthenticated. Attackers can read/write all configuration, users, database connections, and stored VoIP call data.
Fix
Fail closed: if JWT.Secret is empty at startup, abort with a fatal error requiring the operator to set a strong secret. Remove the empty-string shortcircuit from both middleware functions:
if h.jwtSecret == "" {
log.Fatal("coordinator.jwt.secret must be set to a non-empty value")
}If possible, please apply for a CVE number when posting.
Technical POC Analysis
Missing Authentication for Critical Function, CWE-306.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations running HOMER (sipcapture Homer) coordinator with an empty JWT signing secret face unauthenticated remote takeover of the administrative API, exposing user accounts, configuration, database connection strings, and stored VoIP call data. The vulnerability is rated critical (CVSS 9.8), is unauthenticated by vector, and allows attackers to create admin users and alter system data, so leadership should treat it as a severe operational and data-protection risk. Exploitation status is no public exploit identified at time of analysis, and patch status is Patch available per vendor advisory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB