Authentication Bypass Vulnerability in HomeBox by Sysadmins Media

CVE-2026-27981

What is CVE-2026-27981?

HomeBox, a home inventory and organization system, has an authentication vulnerability affecting versions prior to 0.24.0. The issue arises from the way the system tracks failed authentication attempts based on client IP addresses. Attackers can exploit this by forging the X-Real-IP header, bypassing the rate limiting mechanism. Although there is a TrustProxy configuration option, it remains unused in the rate limiter logic, which leads to potential unauthorized access. This vulnerability has been addressed in version 0.24.0.

References