Live › vulnerability › CVE-2026-62252
Go to dashboardHomer, a SIP capture and monitoring web app, ships with a hardcoded default admin password 'sipcapture' and does not force a change on first login. An attacker who knows or guesses this default can log in as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/sipcapture/homer-app | go | all versions | – |
Try logging into the Homer web UI with username admin and password sipcapture, or check whether the default credentials were ever changed in the deployment's configuration.
Upgrade github.com/sipcapture/homer-app to v0.0.0-20260625091610-b2e942031ff8 or later, then change the admin password on every existing deployment.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625091610-b2e942031ff8.
This page as .md · .json · in your agent: get_signal("CVE-2026-62252")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.