Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-03 | 2 | Disclosure2 |
| 2026-03-04 | 1 | Disclosure1 |
CVE-2026-27981 Authentication Rate Limiter Bypass via IP Spoofing in HomeBox Prior to 0.24.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27981
Post summary
CVE-2026-27981 is a rate‑limiter bypass vulnerability in HomeBox versions before 0.24.0, enabling attackers to spoof IP addresses to evade authentication limits.
CVE-2026-27981 HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It deter… https://www.cve.org/CVERecord?id=CVE-2026-27981
Post summary
The text announces CVE-2026-27981, highlighting a flaw in HomeBox’s authentication rate limiter that tracks failed attempts per client IP.
🚨*CVE* CVE-2026-27981 HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It deter… https://www.cve.org/CVERecord?id=CVE-2026-27981 ----- Traducción: CVE-2026-27981 Hom… http://infoflow.cloud`
Post summary
The post announces CVE-2026-27981, noting a flaw in HomeBox's authentication rate limiter that tracks failed attempts per client IP, but provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sysadminsmedia | homebox | - | - | - |