CVE-2026-62253

Published: Oct 7, 2026Modified: Oct 10, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (5)

https://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b

Source: security-advisories@github.com

https://github.com/sipcapture/homer/pull/839

Source: security-advisories@github.com

https://github.com/sipcapture/homer/releases/tag/11.0.283

Source: security-advisories@github.com

https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9

Source: security-advisories@github.com

https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.