CVE-2026-62253: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
Homer before 11.0.283 skips JWT validation when the JWT secret is an empty string, which is the default value. On a default installation, protected API endpoints can therefore be reached without authentication. The record assigns a CVSS base score of 9.8 and identifies 11.0.283 as the patched version.
Overview
Homer is open source telecom observability software. According to the advisory data in the record, both JWT middleware functions return early without validating a token when the JWT secret is an empty string. That empty string is the default value, so the weakness is present in a default installation.
Impact
- The CVSS base score recorded for this CVE is 9.8, which is rated critical.
- The weakness is classified as CWE-306, missing authentication for a critical function.
- Per the record, protected API endpoints are reachable without authentication on a default installation. The SSVC data in the record lists technical impact as total.
Affected products and versions
- Product: Sipcapture Homer.
- Affected: before 11.0.283.
- Fixed in: 11.0.283, as stated in the description and the release reference. The structured fixes field in the record is empty, so the fix information comes from the description and linked references.
Exploitation status
This CVE is not listed in the CISA KEV catalog according to the record, so no active exploitation is confirmed. The sources consulted do not confirm exploitation in the wild. The SSVC data lists exploitation as proof of concept, and the EPSS probability is 0.00423.
Remediation and mitigation
- Upgrade Homer to 11.0.283 or a later release that includes the fix referenced in the GitHub security advisory.
- Until the upgrade is applied, confirm that a non-empty JWT secret is configured and restrict network access to the Homer service to trusted sources.
- Review whether instances were exposed to untrusted networks while running with the default configuration.
Detection guidance
- Review API access logs for requests that succeed without an authentication token, especially from unexpected sources.
- Audit configuration files and deployment settings for an empty or missing JWT secret for the coordinator component.
Limitations of the available information
The record does not provide structured fixed-version data beyond the description, does not list the affected deployments, and does not confirm whether any instance has been compromised. The full set of protected endpoints is described only in general terms.
Frequently asked questions
Which Homer versions are affected by CVE-2026-62253?
The record lists Sipcapture Homer before 11.0.283 as affected.
What is the fixed version?
The record and the linked release reference identify 11.0.283 as the patched version.
Is this vulnerability known to be actively exploited?
No. The record shows the CVE is not listed in the CISA KEV catalog, and the sources consulted do not confirm exploitation in the wild.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.