Live › vulnerability › CVE-2026-62253
Go to dashboardHomer (github.com/sipcapture/homer-app), a SIP monitoring web app, accepts forged authentication tokens when coordinator.jwt.secret is left empty, which is the default. An attacker can bypass login entirely and gain full access to the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/sipcapture/homer-app | go | all versions | – |
Check the Homer config for coordinator.jwt.secret and confirm it is set to a non-empty value.
Set coordinator.jwt.secret to a long random non-empty value and upgrade homer-app to a version at or after v0.0.0-20260625093330-5e90809657c9 (the advisory's fixed pseudo-version; the sources do not name a semver tag).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625093330-5e90809657c9.
This page as .md · .json · in your agent: get_signal("CVE-2026-62253")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.