CVE-2026-62253

GitHubCritical, go

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Both JWT middleware functions (JWTMiddleware and JWTMiddlewareV4) immediately return next(c) when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under /api/v1, /api/v3, and /api/v4 are completely unauthenticated.

No known exploitation
Severity: Critical, CVSS 9.8 (v3.1)
EPSS: 0.42% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
Affected packages: github.com/sipcapture/homer-app (go) < 0.0.0-20260625093330-5e90809657c9, fixed in 0.0.0-20260625093330-5e90809657c9 · GHSA-rqcc-94gv-wjm9