CVE-2026-62252CWE-798hardcoded-credentials

CVE-2026-62252

Critical · published October 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-10-07T21:16Z
References (5)
https://github.com/sipcapture/homer/commit/b2e942031ff8cd7435a244ebef306ee97d16b809 · [email protected]https://github.com/sipcapture/homer/pull/838 · [email protected]https://github.com/sipcapture/homer/releases/tag/11.0.283 · [email protected]https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx · [email protected]https://github.com/sipcapture/homer/security/advisories/GHSA-6xp5-7rcx-xfgx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 03:30Z
    EPSS moved — → 1%
    epss
  • 07 OCT 16:12Z
    Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
    cvelistv5