Authentication Bypass Vulnerability in HomeBox by sysadminsmedia

CVE-2026-85286

What is CVE-2026-85286?

HomeBox, an inventory and organization system, contains a vulnerability in its user login process. Prior to version 0.27.0, the application processes login requests in a way that could allow a remote attacker to identify registered usernames. Specifically, the '/api/v1/users/login' endpoint verifies the password hash only when an existing username is submitted. If the username does not exist, the response is immediate, providing an unauthorized 401; this timing discrepancy allows attackers to discern valid usernames. Despite rate limiting measures, the potential for repeated attempts still poses a risk. This flaw has been addressed in version 0.27.0.

References