Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Critical 9.8

In plain English

A critical-severity hard-coded credentials in homer from sipcapture. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/sipcapture/homer-app	0.0.0-20260625091610-b2e942031ff8	GHSA-6xp5-7rcx-xfgx
Go	github.com/sipcapture/homer-app	no fix listed	GO-2026-6671

Affected products (as reported)

Vendor	Product	Versions
sipcapture	homer	< 11.0.283

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx x_refsource_CONFIRM
https://github.com/sipcapture/homer/pull/838 x_refsource_MISC
https://github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809 x_refsource_MISC
https://github.com/sipcapture/homer/releases/tag/11.0.283 x_refsource_MISC