CVE-2026-62252: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.
References
- github.com/advisories/GHSA-6xp5-7rcx-xfgx
- github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809
- github.com/sipcapture/homer/pull/838
- github.com/sipcapture/homer/releases/tag/11.0.283
- github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
- nvd.nist.gov/vuln/detail/CVE-2026-62252
Code Behaviors & Features
Detect and mitigate CVE-2026-62252 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →