Homer fails to verify its JWT secret when the configuration value is left empty—the default. The authentication middleware immediately forwards the request when the secret is an empty string, allowing any user to reach the API without credentials. This results in complete, unauthenticated access to the endpoints under /api/v1, /api/v3 and /api/v4, exposing all stored data and allowing modification of system state.

The vulnerability affects the sipcapture:homer product. Any installation of versions earlier than 11.0.283 that uses the default configuration, where the bearer token secret is an empty string, is impacted. The fix is provided in the 11.0.283 release and later.

The CVSS v3.1 score of 9.8 indicates critical severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. When the application is deployed with the default empty secret, an attacker can craft simple HTTP requests to protected API endpoints, obtaining or altering data with no special requirements. No complex prerequisites are required beyond access to the network exposed API. The risk therefore remains high until the bug is patched or the secret is reconfigured.