CVE-2026-27981 HomeBox has an Auth Rate Limit Bypass via IP Spoofing
Attackers can bypass authentication rate limits by spoofing IP headers, enabling brute-force attacks against HomeBox.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27981?
CVE-2026-27981 is a high-severity vulnerability in sysadminsmedia homebox, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0.
Weakness: CWE-307
Which versions are affected by CVE-2026-27981?
It affects 1 product.
Products include Sysadminsmedia Homebox.
How do I fix CVE-2026-27981?
No fix has been published for CVE-2026-27981 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-27981 being exploited?
There is no known exploitation of CVE-2026-27981 in the wild and no public exploit code.
Other vulnerabilities in sysadminsmedia homebox
Sources
Also known as GHSA-j86g-v96v-jpp3.