https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T12:36:56.677967+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-62253 CVE-2026-62253 — Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) 2026-10-08T12:36:56.785044+00:00

Affected: sipcapture homer

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.