Homer: Hardcoded default admin password with no forced change

Summary

Homer, an open source observability platform for SIP/VoIP telecom traffic, creates an admin account with the well-known password 'sipcapture' on fresh deployments that use internal authentication. The password is not forced to change at first login. An attacker with network access to the login endpoint can log in as administrator and gain full control of the application, including user management.

Affected

• Homer versions before 11.0.283 using internal authentication (per the CVE record; the GitHub advisory lists <= 11.0.281)
• Fresh deployments that were bootstrapped with the default admin password
• Existing instances bootstrapped with the default password may keep it after upgrading (unverified)
• Whether the legacy Homer 7 line (homer-app) is affected: Unknown.

Fixed in

• Homer 11.0.283 removes the default password. On first bootstrap without an admin password hash, a random password is generated and logged once.

Workaround

• Set an explicit admin password hash in the coordinator configuration before startup.
• Restrict access to the Homer web and API ports to management networks or a VPN until patched.

Exploitation

• The default credential is documented in the GitHub advisory, which includes a login example.
• CISA SSVC assessment: exploitation status PoC, automatable: yes, technical impact: total.
• No reports of in-the-wild exploitation found; CISA KEV listing not confirmed.

Our recommendation

• Upgrade all Homer instances to 11.0.283 or later.
• On every instance deployed before 11.0.283, check whether the admin login with 'sipcapture' still works, and if so reset the password immediately.
• Review admin accounts and sessions for unexpected changes.
• Restrict Homer access to management networks or VPN, and monitor logins to the admin account.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-6xp5-7rcx-xfgx github.com
• Fix commit b2e9420 github.com
• Fix pull request #838 github.com
• Homer release 11.0.283 github.com
• OSV CVE-2026-62252 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:47.