Patch Forecast
Amber warning
Patch this week.

CVE-2026-62253 · GHSA-rqcc-94gv-wjm9

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Risk score
76/100
CVSS
9.8 v3.1
Exploit chance (30 days)
0.4%
Published
7 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, a…
Affected
github.com/sipcapture/homer-app (go) < 0.0.0-20260625093330-5e90809657c9
Fix
Upgrade github.com/sipcapture/homer-app to 0.0.0-20260625093330-5e90809657c9 or later.
Exploitation
No known exploitation

Story map

Story map: github.com/sipcapture/homer-appTHE FLAWSTHE FIXCVE-2026-62253Homer: CompleteAuthentication Bypass Whencoordinator.jwt.secret Is…CVSS 9.8 · EPSS 0%CVE-2026-62252Homer: Hardcoded DefaultAdmin Password 'sipcapture'With No Forced Change on…CVSS 9.8 · EPSS 1%CVE-2026-62251Homer: Authenticated SQLInjection via Unvalidatedrawquery Field in…CVSS 8.1 · EPSS 0%Upgrade…11.0.283or later on your release lineWho is exposedgithub.com/sipcapture/homer-app (go) <0.0.0-20260625091610-b2e942031ff8AMBER · PATCH THIS WEEKgithub.com/sipcapture/homer-appHomer is open source telecomobservability software. Prior toversion 11.0.283, on every freshHomer deployment using internalauthentication, the bootstrapprocess automatically createsan admin account with the…Where it standsNo known exploitationCONNECTS TOSame weaknessMissing authentication (CWE-306)287 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/sipcapture/homer-app: Amber, patch this week. Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism…

The flaws

  • CVE-2026-62253: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) (CVSS 9.8 · EPSS 0%)
  • CVE-2026-62252: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login (CVSS 9.8 · EPSS 1%)
  • CVE-2026-62251: Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query (CVSS 8.1 · EPSS 0%)

The fix

Upgrade github.com/sipcapture/homer-app: 11.0.283 or later on your release line

Who is exposed: github.com/sipcapture/homer-app (go) < 0.0.0-20260625091610-b2e942031ff8

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.8 critical
  • Remotely exploitable without logging in
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/sipcapture/homer-appgo< 0.0.0-20260625093330-5e90809657c90.0.0-20260625093330-5e90809657c9

References

Original description

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.

Last activity 7 Oct 2026. Patch Forecast updates every hour.