{"id":"EUVD-2026-94523","enisaUuid":"3efb0a10-ad49-3cc4-93cf-c675ceabe350","description":"Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret \u003d\u003d \"\"`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.","datePublished":"Oct 7, 2026, 4:11:00 PM","dateUpdated":"Oct 10, 2026, 2:36:21 AM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9\nhttps://github.com/sipcapture/homer/pull/839\nhttps://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b\nhttps://github.com/sipcapture/homer/releases/tag/11.0.283\n","aliases":"CVE-2026-62253\nGHSA-rqcc-94gv-wjm9\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"5b383240-f993-3900-ae33-d2c6f54e55c4","product":{"name":"homer","vendor":{"name":"sipcapture"}},"product_version":"\u003c 11.0.283"}],"enisaIdVendor":[{"id":"951ca2be-62e7-3710-b7bc-04086475e8e8","vendor":{"name":"sipcapture"}}],"enisaIdVulnerability":[{"id":"7bfb5564-c1e3-360b-acdd-99562b051bc8","vulnerability":{"id":"GHSA-rqcc-94gv-wjm9","description":"Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)","datePublished":"Oct 7, 2026, 4:11:58 PM","dateUpdated":"Oct 7, 2026, 4:11:58 PM","baseScore":0.0,"references":"https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9\nhttps://github.com/sipcapture/homer/pull/839\nhttps://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b\nhttps://github.com/sipcapture/homer\nhttps://github.com/sipcapture/homer/releases/tag/11.0.283\n","enisa_id":"EUVD-2026-94523\n","aliases":"CVE-2026-62253\nGHSA-rqcc-94gv-wjm9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"965c7f76-fff3-38b9-b47e-0d0068fa324c","vulnerability":{"id":"CVE-2026-62253","description":"Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret \u003d\u003d \"\"`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.","datePublished":"Oct 7, 2026, 4:11:00 PM","dateUpdated":"Oct 10, 2026, 2:36:21 AM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/sipcapture/homer/security/advisories/GHSA-rqcc-94gv-wjm9\nhttps://github.com/sipcapture/homer/pull/839\nhttps://github.com/sipcapture/homer/commit/5e90809657c9df321db191a69c6050f873f5646b\nhttps://github.com/sipcapture/homer/releases/tag/11.0.283\n","enisa_id":"EUVD-2026-94523\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Oct 30, 2026, 7:14:57 AM","vulnerabilityProduct":[{"id":"340b5fb7-58cc-3bbf-9017-668a990bd2b7","product":{"name":"homer","vendor":{"name":"sipcapture"}},"product_version":"\u003c 11.0.283"}],"vulnerabilityVendor":[{"id":"851440c3-2829-3c7f-9573-b0ab68c3c9cd","vendor":{"name":"sipcapture"}}]}}],"enisaIdAdvisory":[]}