{"id":"CVE-2026-62252","kind":"vulnerability","aliases":["CVE-2026-62252","GHSA-6xp5-7rcx-xfgx","GO-2026-6671"],"related":[],"title":"Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app","description":"Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625091610-b2e942031ff8.","summary":"Homer, a SIP capture and monitoring web app, ships with a hardcoded default admin password 'sipcapture' and does not force a change on first login. An attacker who knows or guesses this default can log in as an administrator.","severity":"critical","cvss":9.8,"epss":0.00653,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/sipcapture/homer-app","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","homer","package","self-hosted","sip"],"not_affected_if":["default-config-changed","network-restricted"],"how_to_check":"Try logging into the Homer web UI with username admin and password sipcapture, or check whether the default credentials were ever changed in the deployment's configuration.","fix":"Upgrade github.com/sipcapture/homer-app to v0.0.0-20260625091610-b2e942031ff8 or later, then change the admin password on every existing deployment.","status":"open","published_at":"2026-10-07T17:16:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:06+00:00","updated_at":"2026-10-23T19:51:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T19:51:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/sipcapture/homer-app to v0.0.0-20260625091610-b2e942031ff8 or later, then change the admin password on every existing deployment.\nunknown","summary":"Homer, a SIP capture and monitoring web app, ships with a hardcoded default admin password 'sipcapture' and does not force a change on first login. An attacker who knows or guesses this default can log in as an administrator.","category":"package","who_cares":["homer","self-hosted","sip","go"],"confidence":0.7,"analyst_note":"Confirm the fixed release tag and whether the upgrade forces a password change for existing installs, using https://pkg.go.dev/vuln/GO-2026-6671 and https://nvd.nist.gov/vuln/detail/CVE-2026-62252.","how_to_check":"Try logging into the Homer web UI with username admin and password sipcapture, or check whether the default credentials were ever changed in the deployment's configuration.\nunknown","needs_analyst":true,"not_affected_if":["default-config-changed","network-restricted"],"severity_if_unknown":"critical"},"cost_usd":0.000416,"input_tokens":2230,"output_tokens":385,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A,30A '-62252':20A,31A '-6671':28A '/sipcapture/homer-app':17A,34A,146C '/sipcapture/homer-app.':97C '6xp5':23A '7rcx':24A 'addit':106C,138C 'admin':4A,55B,84C 'administr':80B 'advisori':101C 'affect':139C 'app':49B 'attack':68B 'automat':112C 'captur':45B 'caus':122C 'chang':10A,63B,90C 'contain':105C 'could':109C 'cve':18A,29A 'default':3A,54B,74B,83C 'edit':133C 'fals':124C 'false-posit':123C 'first':12A,65B,92C 'forc':9A,61B,89C 'ghsa':22A 'ghsa-6xp5-7rcx-xfgx':21A 'github.com':16A,33A,96C,145C 'github.com/sipcapture/homer-app':15A,32A,144C 'github.com/sipcapture/homer-app.':95C 'go':26A,35B,116C 'guess':72B 'hardcod':2A,53B,82C 'homer':1A,36B,42B,81C 'host':40B 'know':70B 'log':76B 'login':13A,66B,93C 'map':113C 'modul':117C,140C 'monitor':47B 'note':98C 'packag':37B 'password':5A,56B,85C 'pleas':130C 'posit':125C 'report':104C,126C,136C 'scanner':129C 'self':39B 'self-host':38B 'ship':50B 'sip':41B,44B 'sipcaptur':6A,57B,86C 'sourc':100C 'standard':115C 'suggest':131C 'v0.0.0-20260625091610-b2e942031ff8':148C 'version':107C,118C,142C 'vulner':128C 'web':48B 'xfgx':25A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6671","url":"https://pkg.go.dev/vuln/GO-2026-6671","severity":null,"published_at":"2026-10-20T00:20:56+00:00","modified_at":"2026-10-20T00:20:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62252","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62252","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62252","severity":null,"published_at":"2026-10-07T17:16:56+00:00","modified_at":"2026-10-08T21:09:00+00:00","first_seen_at":"2026-10-23T19:14:51+00:00","fetched_at":"2026-10-23T19:14:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}