Authentication Bypass in Homer Telecom Observability Software

CVE-2026-62252

What is CVE-2026-62252?

Homer is an open-source telecom observability platform that had a significant vulnerability prior to version 11.0.283. During the initial setup with internal authentication, an 'admin' account was automatically generated with the default password 'sipcapture', stored as a legacy SHA-256 hex hash. This design flaw allowed any attacker who accessed the login endpoint to gain unrestricted administrative rights without any enforced password change after the first login. The vulnerability was addressed in version 11.0.283, emphasizing the need for secure configurations during deployment.

References