EUVD-2026-94455
GHSA-6xp5-7rcx-xfgx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Homer login endpoint over network
-
ExploitSubmit default admin/sipcapture credentials
-
ExecutionReceive admin JWT token
-
ImpactAccess all admin APIs and captured SIP data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Homer coordinator to be running in internal authentication mode (coordinator.auth type "internal", the default/omitted setting) on a deployment where the bootstrap admin row was created with the default DefaultInternalAuthPasswordHash and the admin password has NOT been changed, and the login endpoint (/api/v3/auth) must be reachable by the attacker. No user interaction, authentication, lockout, or rate limiting applies. Exploitation is LIMITED or eliminated when: the operator rotated the admin password after first login, admin_password_hash was explicitly configured (or the fixed version's random-password bootstrap is in effect), LDAP/OAuth auth is used instead of internal, disable_password_login is true, or the login endpoint is not network-exposed. |
| Impact | Raw severity is maximal: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes network-reachable, unauthenticated, low-complexity full compromise, and a working PoC (curl against /api/v3/auth) is published in the GitHub advisory, so publicly available exploit code exists. However, no EPSS probability and no SSVC decision data were supplied, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation - treat this as PoC-available, not in-the-wild. The practical risk is narrower than the 9.8 implies: the flaw only bites FRESH deployments using the internal-auth mode where the operator has not yet changed the admin password and has not switched to LDAP/OAuth, and the affected product (Homer/sipcapture VoIP-SIP capture) is a niche, industry-specific tool rather than ubiquitous infrastructure. Net: a genuine critical for any newly stood-up, internet-exposed Homer instance, but the KEV-absent / EPSS-unknown signals suggest opportunistic or targeted abuse of exposed instances rather than mass worming. Prioritize for exposed/new deployments; de-prioritize where the password was rotated or non-internal auth is in use. |
| Exploit ScenarioDerived | An attacker discovers an internet-reachable Homer instance running internal authentication and POSTs {"username":"admin","password":"sipcapture"} to /api/v3/auth, receiving an admin JWT with no lockout or rate limiting. A public PoC for exactly this exists in the GitHub advisory. Because the vector is AV:N/AC:L/PR:N, no special positioning or user interaction is needed - a single request yields full administrative control over users and captured SIP/VoIP data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Homer (sipcapture/homer-app) deployments running in the default internal authentication mode bootstrap an administrator account with the hardcoded credentials admin / sipcapture and never force a password change, so any unauthenticated attacker who can reach the /api/v3/auth login endpoint can obtain a full admin JWT on a freshly deployed instance. The GitHub advisory publishes working exploit code (a two-request curl sequence against /api/v3/auth and /api/v3/users), and no lockout, rate limiting, or first-login change requirement is in place, making publicly available exploit code exist for this CWE-798 hardcoded-credential flaw. Vendor fixes ship in Homer 11.0.283 (commit b2e942031ff8cd7435a244ebef306ee97d16b809), which replaces the fixed bootstrap hash with a random password logged once at startup or an operator-supplied admin_password_hash.
RemediationAI
Upgrade to the vendor-patched Homer release 11.0.283 (fix commit b2e942031ff8cd7435a244ebef306ee97d16b809, PR #838), which removes the hardcoded DefaultInternalAuthPasswordHash and instead generates a one-time random admin password written to the coordinator logs at first startup, or honors an explicitly configured admin_password_hash. If immediate upgrade is not possible, rotate the admin password right now via Settings → Users in the UI or the --reset-admin-password flow (which supplies a SHA-256 hex hash through admin_password_hash or a bcrypt hash from the setup wizard), since rotating the credential removes the exposure entirely - the trade-off being that password rotation must be performed on every existing instance and re-applied after any fresh deployment. Stronger compensating controls: set coordinator.auth.disable_password_login=true to disable local password login entirely (side effect: administrators must authenticate via LDAP or OAuth, so those integrations must be configured and tested first), switch coordinator.auth type from "internal" to LDAP/OAuth (side effect: existing local users lose access and identity mappings must be provisioned), and restrict network access to /api/v3/auth and the coordinator API behind a reverse proxy, VPN, or firewall allowlist (side effect: legitimate operator and UI access paths must be re-verified to avoid lockout). Because publicly available exploit code exists and exploitation requires only network reachability to the login endpoint with PR:N/AV:N conditions, patch or rotate first and treat any internet-exposed, unrotated Homer instance as compromised, then review users and tokens for unauthorized additions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Go-based Homer coordinator (packaged as Go module github.com/sipcapture/homer-app, CPE pkg:go/github.com_sipcapture_homer-app). At startup, coordinator/services/auth_bootstrap.go calls EnsureBootstrapAdminUser(), which inserts a users-table row with username=admin and password_hash=DefaultInternalAuthPasswordHash when no such row exists; that constant, defined in config/config.go, is the SHA-256 hex digest 883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90 whose cleartext is 'sipcapture' (confirmed by the unit test calling Authenticate(ctx, "admin", "sipcapture")). The root cause class is CWE-798 (Use of Hard-coded Credentials), compounded by the password hash verifier in passwordhash/password.go accepting legacy unsalted SHA-256 hex digests via legacySHA256HexEqual rather than a salted KDF such as bcrypt, which keeps the default credential functional on every deployment and makes the stored digest trivially crackable or reversible. Because login authenticates only against the users table and the bootstrap routine sets no force_change, first_login, or expiry flags, the well-known credential remains valid until an operator manually rotates it. The upstream fix removes the default hash constant and either requires an explicit admin_password_hash (SHA-256 hex for --reset-admin-password, or bcrypt from the setup wizard) or generates a one-time random password printed in the coordinator logs at first startup.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Publicly documented default credentials grant admin over the network with no prior privilege or interaction, so PR:N/UI:N/AV:N/AC:L and full C/I/A impact.
Primary rating from Vendor (https://github.com/sipcapture/homer).
CVSS VectorVendor: https://github.com/sipcapture/homer
DescriptionCVE.org
Summary
On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.
Details
config/config.go lines 858-861:
// DefaultInternalAuthPasswordHash is the SHA-256 hex digest of the default
// bootstrap password (cleartext: sipcapture).
const DefaultInternalAuthPasswordHash = "883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90"coordinator/services/auth_bootstrap.go lines 20-71: EnsureBootstrapAdminUser() runs at startup. If no admin user exists, it inserts a row with username=admin, password_hash=DefaultInternalAuthPasswordHash. No force_change, no first_login flag, no expiry is set.
coordinator/services/auth_bootstrap_test.go line 114 confirms the plaintext:
u, err := svc.Authenticate(ctx, "admin", "sipcapture")passwordhash/password.go lines 36-45: Legacy SHA-256 hex hashes are accepted via legacySHA256HexEqual, so the default credential is functional on any deployment.
PoC
# Authenticate with default credentials - works on any fresh Homer deployment
curl -s -X POST http://<homer-host>/api/v3/auth \
-H 'Content-Type: application/json' \
-d '{"username":"admin","password":"sipcapture"}'
# Response: {"token":"<admin-jwt>","data":{"userGroup":"admin"}}
# Use the token to access all admin functionality
curl -H "Authorization: Bearer <admin-jwt>" http://<homer-host>/api/v3/usersImpact
Use of Hard-coded Credentials (CWE-798). Any attacker who can reach a freshly deployed Homer instance gains immediate full administrative access using the publicly documented default password, with no lockout, rate limiting, or forced password change required.
Fix
Remove the hardcoded DefaultInternalAuthPasswordHash constant. Require operators to provide a hashed admin password in the configuration file. Alternatively, generate a random password on first startup, print it to stdout once, and immediately force a change on first login.
If possible, please apply for a CVE number when posting.
Technical POC Analysis
CWE-798: Use of Hard-coded Credentials.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Homer's default deployment ships with a publicly documented administrator password, so anyone able to reach its login interface can obtain full administrative control of the platform, including the SIP capture data and communications metadata it stores. Because working exploit code is already public and these systems are often deployed as broadly reachable VoIP monitoring infrastructure, any exposed instance should be treated as compromised until proven otherwise. The exposure carries privacy, regulatory, and operational consequences that warrant immediate management attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB