https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:23:18 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-62252 <p>Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.</p> <p>Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access. Version 11.0.283 patches the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-62252 https://vulnerability.circl.lu/vuln/ghsa-6xp5-7rcx-xfgx <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.</p> <p>### Details **`config/config.go` lines 858-861:** ```go // DefaultInternalAuthPasswordHash is the SHA-256 hex digest of the default // bootstrap password (cleartext: sipcapture). const DefaultInternalAuthPasswordHash = &#34;883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90&#34; ```</p> <p>**`coordinator/services/auth_bootstrap.go` lines 20-71:** `EnsureBootstrapAdminUser()` runs at startup. If no admin user exists, it inserts a row with `username=admin`, `password_hash=DefaultInternalAuthPasswordHash`. No `force_change`, no `first_login` flag, no expiry is set.</p> <p>**`coordinator/services/auth_bootstrap_test.go` line 114** confirms the plaintext: ```go u, err := svc.Authenticate(ctx, &#34;admin&#34;, &#34;sipcapture&#34;) ```</p> <p>**`passwordhash/password.go` lines 36-45:** Legacy SHA-256 hex hashes are accepted via `legacySHA256HexEqual`, so the default credential is functional on any deployment.</p> <p>### PoC ```bash # Authenticate with default credentials — works on any fresh Homer deployment curl -s -X POST http://&lt;homer-host&gt;/api/v3/auth \ -H &#39;Content-Type: application/json&#39; \ -d &#39;{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;sipcapture&#34;}&#39; # Response: {&#34;token&#34;:&#34;&lt;ad…</p> <p><strong>Affected:</strong> Go: github.com/sipcapture/homer-app</p> <p>### Summary On every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (stored as a legacy SHA-256 hex hash). There is no first-login forced-change mechanism. Any attacker who reaches the login endpoint immediately gains full administrative access.</p> <p>### Details **`config/config.go` lines 858-861:** ```go // DefaultInternalAuthPasswordHash is the SHA-256 hex digest of the default // bootstrap password (cleartext: sipcapture). const DefaultInternalAuthPasswordHash = &#34;883ffc1f37fd0fe542b0fb9740035c4383e7d976c411161d24e62edace280f90&#34; ```</p> <p>**`coordinator/services/auth_bootstrap.go` lines 20-71:** `EnsureBootstrapAdminUser()` runs at startup. If no admin user exists, it inserts a row with `username=admin`, `password_hash=DefaultInternalAuthPasswordHash`. No `force_change`, no `first_login` flag, no expiry is set.</p> <p>**`coordinator/services/auth_bootstrap_test.go` line 114** confirms the plaintext: ```go u, err := svc.Authenticate(ctx, &#34;admin&#34;, &#34;sipcapture&#34;) ```</p> <p>**`passwordhash/password.go` lines 36-45:** Legacy SHA-256 hex hashes are accepted via `legacySHA256HexEqual`, so the default credential is functional on any deployment.</p> <p>### PoC ```bash # Authenticate with default credentials — works on any fresh Homer deployment curl -s -X POST http://&lt;homer-host&gt;/api/v3/auth \ -H &#39;Content-Type: application/json&#39; \ -d &#39;{&#34;username&#34;:&#34;admin&#34;,&#34;password&#34;:&#34;sipcapture&#34;}&#39; # Response: {&#34;token&#34;:&#34;&lt;ad…</p> https://vulnerability.circl.lu/vuln/ghsa-6xp5-7rcx-xfgx