CVE-2026-62252
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.65% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- github.com/sipcapture/homer-app (go) < 0.0.0-20260625091610-b2e942031ff8, fixed in 0.0.0-20260625091610-b2e942031ff8 · GHSA-6xp5-7rcx-xfgx