Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/sipcapture/homer-app < 0.0.0-20260625085520-a7d027dc684b
Fixed in
0.0.0-20260625085520-a7d027dc684b· Vendor fix available
Issue
The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the FlightSQL service. Details coordinator/handlers/statisticsv4.go lines 74-107 — V4StatisticsQuery: Contrast with coordinator/handlers/search.go line 194 — secure pattern not followed: query.RawQuery is whatever the caller submitted; it is passed verbatim to the FlightSQL/DuckDB backend. The handler is registered under the protected group (requires JWT), but given that the default JWT secret is empty (see related advisory), this is effectively pre-authentication on a default deployment. PoC Impact SQL Injection / Improper Neutralization of Special Elements (CWE-89). Any authenticated user can execute arbitrary SQL against all data accessible to the FlightSQL/DuckDB backend — including all stored…
Recommended action: Upgrade to 0.0.0-20260625085520-a7d027dc684b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/sipcapture/homer-app < 0.0.0-20260625091610-b2e942031ff8
Fixed in
0.0.0-20260625091610-b2e942031ff8· Vendor fix available
Issue
On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Details config/config.go lines 858-861: coordinator/services/authbootstrap.go lines 20-71: EnsureBootstrapAdminUser() runs at startup. If no admin user exists, it inserts a row with username=admin, passwordhash=DefaultInternalAuthPasswordHash. No forcechange, no firstlogin flag, no expiry is set. coordinator/services/authbootstraptest.go line 114 confirms the plaintext: passwordhash/password.go lines 36-45: Legacy SHA-256 hex hashes are accepted via legacySHA256HexEqual, so the default credential is functional on any deployment. PoC Impact Use of Hard-coded Credentials (CWE-798). Any attacker who can reach a freshly deployed Homer instance gains…
Recommended action: Upgrade to 0.0.0-20260625091610-b2e942031ff8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/sipcapture/homer-app < 0.0.0-20260625093330-5e90809657c9
Fixed in
0.0.0-20260625093330-5e90809657c9· Vendor fix available
Issue
Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated. Details coordinator/handlers/auth.go lines 298-304: coordinator/handlers/authv4helpers.go lines 177-182: coordinator/coordinator.go lines 315-317: config/config.go line 845: Secret field struct tag has default:"". The example config ships a placeholder value, but the Go struct default (used when no config is provided) is empty. PoC Impact Missing Authentication for Critical Function (CWE-306). On a default Homer installation with no JWT secret configured, every admin API endpoint is completely unauthenticated. Attackers can read/write all configuration, users, database connections, and stored VoIP call data. Fix Fail closed: if JWT.Secret is empty at startup, abort with a fatal error requiring the…
Recommended action: Upgrade to 0.0.0-20260625093330-5e90809657c9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.