CRITICALCVSS 9.8Vulnerability
CVE-2026-62253
Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under `/api/v1`, `/api/v3`, and `/api/v4` are completely unauthenticated. Version 11.0.283 patches the issue.
Properties
- Severity
- CRITICAL
- Summary
- Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
- Epss score
- 0.00423
- Cvss score
- 9.8
- Cvss severity
- CRITICAL
- Retrieved at
- 2026-10-21T01:24:50+00:00
- Ghsa published
- 2026-10-07T16:11:58Z
- Source url
- https://github.com/advisories/GHSA-rqcc-94gv-wjm9
- Ghsa updated
- 2026-10-07T16:11:59Z
- Ghsa id
- GHSA-rqcc-94gv-wjm9
- Score
- 9.8
- Last source
- FIRST EPSS
- Cve id
- CVE-2026-62253
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-07T22:35:46+00:00
- Is ghsa only
- false
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-10-07T17:16:56.627
- Last modified
- 2026-10-10T03:17:07.570
- Epss percentile
- 0.35246
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph