CVE-2026-27981 Details
Description
HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0.
A vulnerability in HomeBox versions prior to 0.24.0 allows for authentication rate limit bypass through IP spoofing. The rate limiter tracks failed login attempts based on client IP, which is determined by the X-Real-IP header, the first entry of the X-Forwarded-For header, and the remote address of the TCP connection. These headers were read unconditionally, without verifying if HomeBox was behind a trusted proxy. As a result, an attacker could forge the X-Real-IP header, creating a new rate limit identity for each request. This issue is exacerbated by the fact that the TrustProxy option, intended to handle such scenarios, was never implemented in the middleware or rate limiter code. The vulnerability allows direct attackers to brute-force accounts, particularly in self-hosted deployments without a reverse proxy or external rate limiting.
Users can upgrade to HomeBox version 0.24.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j86g-v96v-jpp3 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysadminsmedia homebox | < 0.24.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | Initial Analysis | [email protected] |
| Mar 3, 2026 | New CVE Received | [email protected] |