Homebox
CVE-2026-27981
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect directly to HomeBox server
-
ExploitForge X-Real-IP header with unique values
-
ExecutionBypass rate limiter tracking
-
ImpactPerform brute force authentication attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
| Exploitation Conditions | HomeBox versions before 0.24.0 with TrustProxy option disabled (default configuration). Attacker must connect directly to the HomeBox instance without routing through trusted proxy infrastructure. X-Real-IP header must be processed by the authentication rate limiter without proxy validation. |
| Impact | CVSS 7.4 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Homebox prior to version 0.24.0 fails to validate the TrustProxy configuration setting, allowing attackers to bypass authentication rate limiting by forging the X-Real-IP header on direct connections. This enables an attacker to attempt unlimited authentication attempts by spoofing a different IP address for each request, compromising both confidentiality and integrity of the system. The vulnerability affects all Homebox installations where the TrustProxy option is disabled or misconfigured.
Earlier versions of this analysis (1)
Homebox versions up to 0.24.0 is affected by improper restriction of excessive authentication attempts (CVSS 7.4).
RemediationAI
Fixed in version 0.24.0.. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-307: Improper Restriction of Excessive Authentication Attempts) affects Homebox. HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a T
Know when Homebox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0.
Executive ViewAI
HomeBox instances prior to version 0.24.0 are vulnerable to authentication bypass attacks where attackers can circumvent rate limiting by forging IP headers, potentially enabling credential brute-force attacks. Organizations using affected versions face elevated risk of unauthorized account access and data exposure from home inventory systems.
Implement Web Application Firewall (WAF) rules to sanitize or block X-Real-IP and X-Forwarded-For headers from untrusted sources; configure reverse proxy to override these headers with verified client IP only; restrict HomeBox to internal network access only; enforce stronger authentication (MFA) on all accounts; increase monitoring and alerting on failed login attempts; disable HomeBox if not actively used until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in HomeBox XSS and Security Issues
View all 3Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to th
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwri
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notifi
Broken access control in HomeBox prior to 0.25.0 allows authenticated users with revoked group access to continue perfor
Authenticated server-side request forgery in HomeBox before 0.27.0 lets any member of a collection point a generic notif
Server-side request forgery in HomeBox prior to 0.26.0 allows an authenticated user with permission to create or test no
Broken authorization in HomeBox prior to 0.26.0 lets any authenticated low-privilege user force an arbitrary account int
Exploit-DB