CVE-2026-62253
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.
| CWE | CWE-306 |
| Vendor | sipcapture |
| Product | homer |
| Published | Oct 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for sipcapture homer
Be the first to know when new critical vulnerabilities affecting sipcapture homer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
sipcapture / homer
< 11.0.283
References
github.com: https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9 github.com: https://github.com/sipcapture/homer/pull/839 github.com: https://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b github.com: https://github.com/sipcapture/homer/releases/tag/11.0.283