CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
Attackers can gain full administrative access to Homer deployments using the default hardcoded password without any forced change mechanism.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62252?
CVE-2026-62252 is a critical vulnerability in sipcapture homer, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
Weakness: CWE-798
Which versions are affected by CVE-2026-62252?
3 open source packages ship an affected version, including github.com/sipcapture/homer-app.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sipcapture/homer-app Go | All versions | None |
github.com/sipcapture/homer-app Go | All versions | 0.0.0-20260625091610-b2e942031ff8 |
github.com/sipcapture/homer-app Go | All versions | 0.0.0-20260625091610-b2e942031ff8 |
How do I fix CVE-2026-62252?
Upgrade github.com/sipcapture/homer-app to 0.0.0-20260625091610-b2e942031ff8 or later.
Is CVE-2026-62252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62252 exists.
Sources
Also known as GHSA-6xp5-7rcx-xfgx, GO-2026-6671.