Homer vulnerabilities

Homer, open source telecom observability software, prior to version 11.0.283 has a vulnerability where JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret` is empty. The JWT secret defaults to an empty string, leaving all protected API endpoints completely unauthenticated.

Homer prior to version 11.0.283, on every fresh deployment using internal authentication, automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism, allowing any attacker to gain full administrative access.

Homer, open source telecom observability software, before version 11.0.283 is vulnerable to SQL injection in the V4StatisticsQuery handler. The user-supplied rawquery field is passed directly to DuckDB without calling sqlvalidator.ValidateRawSQL, allowing any authenticated user to execute arbitrary SQL statements against all data accessible via the FlightSQL service.