Zulip Template
Monthly
Credential and cryptographic-key exposure in the VPS.org one-click Zulip deployment template ships every instance with an identical hardcoded application signing key, a default database password of "zulip", and HTTPS disabled (DISABLE_HTTPS=True), allowing remote attackers who know the public template defaults to forge authenticated sessions, read Zulip's database, and intercept traffic. Any organization that provisioned Zulip through this VPS.org one-click image is affected until the secrets are rotated. There is no public exploit identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), but SSVC rates technical impact as total and automatable, reflecting that the shared secrets are identical across all deployments.
Credential and cryptographic-key exposure in the VPS.org one-click Zulip deployment template ships every instance with an identical hardcoded application signing key, a default database password of "zulip", and HTTPS disabled (DISABLE_HTTPS=True), allowing remote attackers who know the public template defaults to forge authenticated sessions, read Zulip's database, and intercept traffic. Any organization that provisioned Zulip through this VPS.org one-click image is affected until the secrets are rotated. There is no public exploit identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), but SSVC rates technical impact as total and automatable, reflecting that the shared secrets are identical across all deployments.