CVE-2026-62253
CriticalCVSS 9.8Summary
Homer, open source telecom observability software, prior to version 11.0.283 has a vulnerability where JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret` is empty. The JWT secret defaults to an empty string, leaving all protected API endpoints completely unauthenticated.
Risk Assessment
An attacker could gain unauthorized access to sensitive telecom data and API functions, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade Homer to version 11.0.283 or later, which includes the fix.
Other vulnerabilities in Homer
See all- CVE-2026-62251High
Homer, open source telecom observability software, before version 11.0.283 is vulnerable to SQL injection in the V4StatisticsQuery handler. The user-supplied rawquery field is passed directly to DuckDB without calling sqlvalidator.ValidateRawSQL, allowing any authenticated user to execute arbitrary SQL statements against all data accessible via the FlightSQL service.
- CVE-2026-62252Critical
Homer prior to version 11.0.283, on every fresh deployment using internal authentication, automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism, allowing any attacker to gain full administrative access.
Original NVD description (English source)
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS