Skip to content
OpenAdvisories

Package · Go

github.com/sipcapture/homer-app

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2026-62252

    Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

    Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SH…

    sipcapture homer github.com/sipcapture/homer-app Go
  • Critical 9.8
    CVE-2026-62253

    Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

    Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret defaults to an empty string. On a default…

    sipcapture homer github.com/sipcapture/homer-app Go
  • High 8.1
    CVE-2026-62251

    Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

    Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used throughout the rest of…

    sipcapture homer github.com/sipcapture/homer-app Go