Read the docs
TI-2026-69214 Aliases CVE-2026-62253GHSA-rqcc-94gv-wjm9

Authentication bypass in Homer when JWT secret is empty

Priority HIGH 82CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

Homer, open source telecom observability software, is affected before version 11.0.283. Both JWT middleware functions accept every request when the JWT secret is empty, which is the default, so protected API endpoints under /api/v1, /api/v3 and /api/v4 are unauthenticated (CWE-306). A remote attacker without credentials can reach these endpoints on a default installation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00537 45th percentileScored 2026-11-07
Fix Fixed homer (sipcapture): 11.0.283github.com/sipcapture/homer-app (Go): 0.0.0-20260625093330-5e90809657c9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sipcapturehomerbefore 11.0.28311.0.283Patch availableCNA
—github.com/sipcapture/homer-app (Go)before 0.0.0-20260625093330-5e90809657c90.0.0-20260625093330-5e90809657c9Patch availableGHSA-rqcc-94gv-wjm9
  • homer Vendorsipcapture Affected before 11.0.283 Fixed in 11.0.283 Patch available CNA
  • github.com/sipcapture/homer-app (Go) Vendor— Affected before 0.0.0-20260625093330-5e90809657c9 Fixed in 0.0.0-20260625093330-5e90809657c9 Patch available GHSA-rqcc-94gv-wjm9

Remediation

Upgrade Homer to version 11.0.283 or later. For the Go module github.com/sipcapture/homer-app, update to 0.0.0-20260625093330-5e90809657c9.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA homer (sipcapture) Fixed in 11.0.283
  • Fix · GHSA-rqcc-94gv-wjm9 github.com/sipcapture/homer-app (Go) Fixed in 0.0.0-20260625093330-5e90809657c9 Advisory →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-62253
  2. 2026-10-07 Alias added: GHSA-rqcc-94gv-wjm9
  3. 2026-10-07 Fix available: Go/github.com/sipcapture/[email protected] · GHSA-rqcc-94gv-wjm9
  4. 2026-10-07 CVSS score added · GHSA-rqcc-94gv-wjm9
  5. 2026-10-07 Weakness changed · GHSA-rqcc-94gv-wjm9
  6. 2026-10-07 5 new references · GHSA-rqcc-94gv-wjm9
  7. 2026-10-10 CISA SSVC decision points changed
  8. 2026-10-10 Priority changed: MEDIUM → HIGH

References

Other 5

  • TI-2026-69213 Hardcoded default admin password in Homer lets attackers log in CVSS 3.1CRITICAL 9.8
  • TI-2026-69212 SQL injection in Homer statistics API lets users run arbitrary SQL CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences