CVE-2026-62252

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse1 post

Upwind Security MDR@UpwindMDR18h
🚨Critical - Homer Auth Bypasses (CVE-2026-62252 / CVE-2026-62253) Homer (http://github.com/sipcapture/homer) has two critical auth issues prior to 11.0.283: Bootstrap creates an admin account with hardcoded password sipcapture and no forced rotation on first login. JWT secret defaults to empty string, so all protected API endpoints (/api/v1, /api/v3, /api/v4) are completely unauthenticated. Any attacker with network access can gain full administrative control. 👉Affected: homer < 11.0.283 | Upgrade to 11.0.283
0000048
315 followersView on X

Explore more

Back to dashboard