Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

published 2026-10-07 32 d ago modified 2026-10-20 20 d ago also GHSA-6xp5-7rcx-xfgx , GO-2026-6671 , EUVD-2026-94455

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Patch / fix

fixed in 1 links 3

go github.com/sipcapture/homer-app 0.0.0-20260625091610-b2e942031ff8

github.com/sipcapture/homer@b2e9420 commit
github.com/sipcapture/homer#838 pull request
github.com/sipcapture/homer/releases/tag/11.0.283 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 32 d ago (2026-10-07)

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/sipcapture/homer-app	<0.0.0-20260625091610-b2e942031ff8 all versions	0.0.0-20260625091610-b2e942031ff8

Affected products

sipcapture homer

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

github.com /sipcapture/homer/pull/838
web
github.com /sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809
web
github.com /sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx
exploit, web, advisory
github.com /sipcapture/homer/releases/tag/11.0.283
web
github.com /sipcapture/homer
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary