Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

{
  "id": "dd2457eb864d069df28efeff3530f59a19b6374bed29de0d770eb7f8fbf12926",
  "url": "https://osv.dev/vulnerability/GHSA-rqcc-94gv-wjm9",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)",
    "summary": "### Summary Both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == \"\"`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. ### Details **`coordinator/handlers/auth.go` lines 298-304:** ```go func (h *Auth) JWTMiddleware() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == \"\" { return next(c) // bypass — no validation performed } ``` **`coordinator/handlers/auth_v4_helpers.go` lines 177-182:** ```go func (h *Auth) JWTMiddlewareV4() echo.MiddlewareFunc { return func(next echo.HandlerFunc) echo.HandlerFunc { return func(c echo.Context) error { if h.jwtSecret == \"\" { return next(c) // same bypass ``` **`coordinator/coordinator.go` lines 315-317:** ```go if c.config.JWT.Secret != \"\" { protected.Use(authHandler.JWTMiddleware()) // middleware not even registered when secret is empty } ``` **`config/config.go` line 845:** `Secret` field struct tag has `default:\"\"`. The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty. ### PoC ```bash # On a default Homer installation (no JWT secret configured), all protected routes are open: curl http:///api/v3/users # Returns full user list with no credentials curl http:///api/v3/databases # Returns all database connection string",
    "evidence": "osv:GHSA-rqcc-94gv-wjm9",
    "products": [
      {
        "name": {
          "value": "github.com/sipcapture/homer-app",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260625093330-5e90809657c9",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "GHSA-rqcc-94gv-wjm9",
      "aliases": [
        "CVE-2026-62253",
        "GHSA-rqcc-94gv-wjm9",
        "GO-2026-6673"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260625093330-5e90809657c9"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/sipcapture/homer-app",
            "purl": "pkg:golang/github.com/sipcapture/homer-app",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rqcc-94gv-wjm9/GHSA-rqcc-94gv-wjm9.json"
          }
        }
      ],
      "modified": "2026-10-20T00:55:52.571323559Z",
      "provider": "osv",
      "references": [
        "https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9",
        "https://github.com/sipcapture/homer/pull/839",
        "https://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b",
        "https://github.com/sipcapture/homer",
        "https://github.com/sipcapture/homer/releases/tag/11.0.283"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-306"
        ],
        "severity": "CRITICAL",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-07T16:11:58Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-62253",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 376881,
  "published_at": "2026-10-07T16:11:58+00:00"
}