Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.

Affected: Go: github.com/sipcapture/homer-app

### Summary On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.

### Details **`config/config.go` lines 858-861:** ```go // DefaultInternalAuthPasswordHash is the SHA-256 hex digest of the default // bootstrap password (cleartext: sipcapture). const DefaultInternalAuthPasswordHash = "883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90" ```

**`coordinator/services/auth_bootstrap.go` lines 20-71:** `EnsureBootstrapAdminUser()` runs at startup. If no admin user exists, it inserts a row with `username=admin`, `password_hash=DefaultInternalAuthPasswordHash`. No `force_change`, no `first_login` flag, no expiry is set.

**`coordinator/services/auth_bootstrap_test.go` line 114** confirms the plaintext: ```go u, err := svc.Authenticate(ctx, "admin", "sipcapture") ```

**`passwordhash/password.go` lines 36-45:** Legacy SHA-256 hex hashes are accepted via `legacySHA256HexEqual`, so the default credential is functional on any deployment.

### PoC ```bash # Authenticate with default credentials — works on any fresh Homer deployment curl -s -X POST http://<homer-host>/api/v3/auth \ -H 'Content-Type: application/json' \ -d '{"username":"admin","password":"sipcapture"}' # Response: {"token":"<ad…