CVE-2026-62252 in Homer
Summary
by MITRE • 10/07/2026
Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
Homer, an open-source telecom observability platform designed for monitoring and analyzing SIP traffic and VoIP networks, suffered from a critical default credential vulnerability in versions prior to 11.0.283. The core of this security flaw lies within the application's initialization sequence, specifically during the bootstrap process when deploying Homer with its internal authentication mechanism enabled. Upon installation, the software automatically provisions an administrative user account identified by the username admin and assigns it a static default password of sipcapture. This credential is not randomly generated or derived from secure entropy sources but remains hardcoded as part of the deployment logic to facilitate initial setup convenience for developers and administrators.
The technical severity of this vulnerability is compounded by the fact that the default password, sipcapture, is stored in the database using a legacy SHA-256 hex hash format rather than modern, salted hashing algorithms like bcrypt or Argon2. While SHA-256 provides collision resistance, it lacks the computational cost and salting mechanisms necessary to protect against brute-force attacks when used without additional safeguards for password storage. More critically, there is no enforcement mechanism requiring users to change this default credential upon their first login. This absence of a forced-password-change policy means that any instance deployed with internal authentication retains these weak credentials indefinitely unless manually modified by an administrator who may be unaware of the risk or neglects to perform the necessary configuration updates.
From an operational perspective, this vulnerability presents a severe risk because it allows for immediate and unauthenticated administrative access if the application is exposed to a network where attackers can reach the login endpoint. Since Homer often manages sensitive telecommunications data, including call detail records and real-time traffic analysis, unauthorized full administrative access could lead to significant confidentiality breaches, integrity violations, or availability disruptions. Attackers leveraging this flaw do not need to exploit complex code execution paths; they simply utilize well-known default credentials that are publicly documented in the software's repository and issue trackers. This aligns with Common Weakness Enumeration (CWE) category CWE-798: Use of Hard-coded Credentials, which describes situations where authentication data is embedded directly into source code or configuration files without adequate protection.
The exploitation vector for this vulnerability typically involves network reconnaissance followed by credential stuffing against the web login interface. If Homer is deployed in a DMZ or exposed to the internet with internal authentication enabled and no reverse proxy enforcing additional access controls, attackers can easily identify the application through common port scanning techniques. Once identified, they attempt to log in using the default admin/sipcapture combination. Success grants them full control over the system, including the ability to modify user roles, export sensitive call logs, alter monitoring configurations, or potentially pivot into internal network segments depending on Homer's integration with other systems. This scenario is consistent with MITRE ATT&CK technique T1078: Valid Accounts, where adversaries use legitimate credentials obtained through default configuration errors to establish persistence and move laterally within the target environment.
To mitigate this vulnerability, organizations running versions of Homer prior to 11.0.283 must immediately upgrade to version 11.0.283 or any subsequent release that addresses this issue by implementing proper credential rotation policies during initialization. For deployments where upgrading is not immediately feasible, administrators should manually change the default admin password to a strong, unique passphrase and ensure it is stored using a robust hashing algorithm supported by the application's configuration options. Additionally, deploying Homer behind an authentication gateway or reverse proxy that enforces multi-factor authentication can provide an additional layer of defense against credential-based attacks. Regular security audits and adherence to secure deployment checklists that mandate default password changes are essential practices to prevent similar vulnerabilities in future deployments.