{"id":"CVE-2026-62253","kind":"vulnerability","aliases":["CVE-2026-62253","GHSA-rqcc-94gv-wjm9","GO-2026-6673"],"related":[],"title":"Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app","description":"Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625093330-5e90809657c9.","summary":"Homer (github.com/sipcapture/homer-app), a SIP monitoring web app, accepts forged authentication tokens when coordinator.jwt.secret is left empty, which is the default. An attacker can bypass login entirely and gain full access to the application.","severity":"critical","cvss":9.8,"epss":0.00423,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/sipcapture/homer-app","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","homer","package","self-hosted","sip-monitoring"],"not_affected_if":["not-exposed-to-network","secret-configured"],"how_to_check":"Check the Homer config for coordinator.jwt.secret and confirm it is set to a non-empty value.","fix":"Set coordinator.jwt.secret to a long random non-empty value and upgrade homer-app to a version at or after v0.0.0-20260625093330-5e90809657c9 (the advisory's fixed pseudo-version; the sources do not name a semver tag).","status":"open","published_at":"2026-10-07T17:16:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:00+00:00","updated_at":"2026-10-23T19:51:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:51:00Z","model":"claude-haiku-5-5","output":{"fix":"Set coordinator.jwt.secret to a long random non-empty value and upgrade homer-app to a version at or after v0.0.0-20260625093330-5e90809657c9 (the advisory's fixed pseudo-version; the sources do not name a semver tag).","summary":"Homer (github.com/sipcapture/homer-app), a SIP monitoring web app, accepts forged authentication tokens when coordinator.jwt.secret is left empty, which is the default. An attacker can bypass login entirely and gain full access to the application.","category":"package","who_cares":["homer","self-hosted","go","sip-monitoring"],"confidence":0.7,"analyst_note":"Confirm the exact fixed version and the default config behaviour in the GHSA-rqcc-94gv-wjm9 / GO-2026-6673 advisory before publishing the check and fix steps.","how_to_check":"Check the Homer config for coordinator.jwt.secret and confirm it is set to a non-empty value.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["secret-configured","not-exposed-to-network"],"severity_if_unknown":"critical"},"cost_usd":0.000422,"input_tokens":2228,"output_tokens":399,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A,26A '-62253':16A,27A '-6673':24A '/sipcapture/homer-app':13A,30A,136C '/sipcapture/homer-app),':43B '/sipcapture/homer-app.':87C '94gv':20A 'accept':49B 'access':71B 'addit':96C,128C 'advisori':91C 'affect':129C 'app':48B 'applic':74B 'attack':63B 'authent':3A,51B,77C 'automat':102C 'bypass':4A,65B,78C 'caus':112C 'complet':2A,76C 'contain':95C 'coordinator.jwt.secret':6A,54B,80C 'could':99C 'cve':14A,25A 'default':9A,61B,83C 'edit':123C 'empti':8A,57B,82C 'entir':67B 'fals':114C 'false-posit':113C 'forg':50B 'full':70B 'gain':69B 'ghsa':18A 'ghsa-rqcc-94gv-wjm9':17A 'github.com':12A,29A,42B,86C,135C 'github.com/sipcapture/homer-app':11A,28A,134C 'github.com/sipcapture/homer-app),':41B 'github.com/sipcapture/homer-app.':85C 'go':22A,31B,106C 'homer':1A,32B,40B,75C 'host':36B 'left':56B 'login':66B 'map':103C 'modul':107C,130C 'monitor':39B,46B 'note':88C 'packag':33B 'pleas':120C 'posit':115C 'report':94C,116C,126C 'rqcc':19A 'scanner':119C 'self':35B 'self-host':34B 'sip':38B,45B 'sip-monitor':37B 'sourc':90C 'standard':105C 'suggest':121C 'token':52B 'v0.0.0-20260625093330-5e90809657c9':138C 'version':97C,108C,132C 'vulner':118C 'web':47B 'wjm9':21A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6673","url":"https://pkg.go.dev/vuln/GO-2026-6673","severity":null,"published_at":"2026-10-20T00:20:56+00:00","modified_at":"2026-10-20T00:20:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62253","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62253","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62253","severity":null,"published_at":"2026-10-07T17:16:56+00:00","modified_at":"2026-10-10T03:17:07+00:00","first_seen_at":"2026-10-23T19:14:51+00:00","fetched_at":"2026-10-23T19:14:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}