Read the docs
TI-2026-69213 Aliases CVE-2026-62252GHSA-6xp5-7rcx-xfgx

Hardcoded default admin password in Homer lets attackers log in

Priority HIGH 82CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-798.

Summary

Homer before 11.0.283 and the github.com/sipcapture/homer-app Go module before 0.0.0-20260625091610-b2e942031ff8 are affected. The bootstrap process creates an admin account with the hardcoded password sipcapture on fresh deployments using internal authentication, and it forces no password change on first login (CWE-798). An unauthenticated remote attacker who reaches the login endpoint gains full administrative access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00653 51st percentileScored 2026-11-07
Fix Fixed homer (sipcapture): 11.0.283github.com/sipcapture/homer-app (Go): 0.0.0-20260625091610-b2e942031ff8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sipcapturehomerbefore 11.0.28311.0.283Patch availableCNA
—github.com/sipcapture/homer-app (Go)before 0.0.0-20260625091610-b2e942031ff80.0.0-20260625091610-b2e942031ff8Patch availableGHSA-6xp5-7rcx-xfgx
  • homer Vendorsipcapture Affected before 11.0.283 Fixed in 11.0.283 Patch available CNA
  • github.com/sipcapture/homer-app (Go) Vendor— Affected before 0.0.0-20260625091610-b2e942031ff8 Fixed in 0.0.0-20260625091610-b2e942031ff8 Patch available GHSA-6xp5-7rcx-xfgx

Remediation

Upgrade Homer to version 11.0.283 or later. Update the github.com/sipcapture/homer-app Go module to 0.0.0-20260625091610-b2e942031ff8 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA homer (sipcapture) Fixed in 11.0.283
  • Fix · GHSA-6xp5-7rcx-xfgx github.com/sipcapture/homer-app (Go) Fixed in 0.0.0-20260625091610-b2e942031ff8 Advisory →

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-62252
  2. 2026-10-07 Alias added: GHSA-6xp5-7rcx-xfgx
  3. 2026-10-07 Fix available: Go/github.com/sipcapture/[email protected] · GHSA-6xp5-7rcx-xfgx
  4. 2026-10-07 CVSS score added · GHSA-6xp5-7rcx-xfgx
  5. 2026-10-07 Weakness changed · GHSA-6xp5-7rcx-xfgx
  6. 2026-10-07 5 new references · GHSA-6xp5-7rcx-xfgx
  7. 2026-10-07 CISA SSVC decision points changed
  8. 2026-10-07 Priority changed: MEDIUM → HIGH
  9. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Other 5

  • TI-2026-69214 Authentication bypass in Homer when JWT secret is empty CVSS 3.1CRITICAL 9.8
  • TI-2026-69212 SQL injection in Homer statistics API lets users run arbitrary SQL CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences