CVE-2026-27824: Calibre-ebook Auth Bypass Vulnerability

CVE-2026-27824 Overview

CVE-2026-27824 is an authentication bypass vulnerability in calibre, a popular cross-platform e-book manager used for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism contains a critical flaw in how it derives ban keys from IP addresses. The server uses both the remote_addr and the X-Forwarded-For header to create ban keys, but fails to validate the X-Forwarded-For header against a trusted proxy configuration.

This improper enforcement of authentication attempt limiting (CWE-307) allows remote attackers to bypass IP-based bans entirely by simply modifying or adding the X-Forwarded-For header in their HTTP requests, rendering the brute-force protection completely ineffective.

Critical Impact

Internet-exposed calibre Content Servers are vulnerable to credential stuffing and password guessing attacks due to completely bypassable brute-force protection, potentially leading to unauthorized access to e-book libraries and user accounts.

Affected Products

• calibre-ebook calibre versions prior to 9.4.0
• calibre Content Server deployments exposed to the internet
• Self-hosted calibre instances without additional authentication layers

Discovery Timeline

• 2026-02-27 - CVE-2026-27824 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-27824

Vulnerability Analysis

The vulnerability exists in calibre Content Server's authentication rate-limiting mechanism. When a user attempts to authenticate, the server tracks failed login attempts to prevent brute-force attacks. However, the implementation flaw lies in how the server constructs the unique identifier (ban key) used to track these attempts.

The server combines the client's remote_addr (the actual IP address from the TCP connection) with the value from the X-Forwarded-For HTTP header to create this ban key. The X-Forwarded-For header is commonly used by reverse proxies and load balancers to preserve the original client IP address. However, calibre reads this header directly from the incoming HTTP request without any validation or trusted-proxy configuration.

Since any client can freely set the X-Forwarded-For header to arbitrary values, an attacker can simply rotate or modify this header value with each authentication attempt. Each unique header value generates a new ban key, effectively giving the attacker unlimited authentication attempts from a single IP address.

Root Cause

The root cause is improper trust of client-supplied HTTP headers without validation. The X-Forwarded-For header should only be trusted when requests originate from known, trusted reverse proxies. By blindly incorporating this user-controlled header into the ban key derivation, the brute-force protection becomes trivially bypassable. This represents a failure to properly implement CWE-307 (Improper Restriction of Excessive Authentication Attempts).

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP authentication requests to the calibre Content Server while rotating the X-Forwarded-For header value with each request.

For example, an attacker could systematically attempt password guesses by including different values in the X-Forwarded-For header (such as 1.1.1.1, 1.1.1.2, 1.1.1.3, etc.) with each login attempt. Since each unique header value produces a new ban key, the attacker never triggers the brute-force protection threshold, allowing unlimited authentication attempts. This technique enables effective credential stuffing attacks against calibre servers exposed to the internet where brute-force protection was intended to be the primary defense mechanism. For technical implementation details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27824

Indicators of Compromise

• Multiple failed authentication attempts from the same source IP but with varying X-Forwarded-For header values
• High volume of login attempts to the calibre Content Server within a short time window
• Authentication logs showing sequential or patterned IP addresses in the X-Forwarded-For header
• Unusual authentication traffic patterns targeting the Content Server's login endpoint

Detection Strategies

• Monitor authentication logs for anomalous patterns of failed login attempts with rotating header values
• Implement web application firewall (WAF) rules to detect and block requests with suspicious X-Forwarded-For header patterns
• Deploy SentinelOne Singularity XDR to detect brute-force attack patterns targeting calibre instances
• Configure alerting for high-frequency authentication failures from single source IPs regardless of header content

Monitoring Recommendations

• Enable verbose logging on the calibre Content Server to capture full HTTP header information
• Set up SIEM rules to correlate authentication failures with X-Forwarded-For header variations
• Implement rate limiting at the network perimeter level independent of application-layer controls
• Review access logs regularly for signs of credential stuffing or password spraying attacks

How to Mitigate CVE-2026-27824

Immediate Actions Required

• Upgrade calibre to version 9.4.0 or later immediately to apply the security fix
• If immediate upgrade is not possible, restrict network access to the calibre Content Server using firewall rules
• Implement strong, unique passwords for all calibre user accounts
• Consider placing the calibre Content Server behind a reverse proxy with additional authentication
• Disable internet exposure of the calibre Content Server if not required

Patch Information

Version 9.4.0 of calibre contains the fix for this vulnerability. Users should update to this version or later to remediate the issue. The patch addresses the improper handling of the X-Forwarded-For header in the brute-force protection mechanism. For more information, see the GitHub Security Advisory.

Workarounds

• Deploy a reverse proxy (such as nginx or Apache) in front of calibre with properly configured X-Forwarded-For handling and its own rate limiting
• Implement IP-based access controls at the firewall level to restrict access to trusted networks only
• Use VPN access for remote connections to the calibre Content Server instead of direct internet exposure
• Enable additional authentication mechanisms such as HTTP Basic Auth at the proxy level
• Consider using fail2ban or similar tools to monitor and block suspicious authentication patterns at the network level

# Example nginx rate limiting configuration as a workaround
# Place this in front of your calibre Content Server

# Define rate limiting zone
limit_req_zone $binary_remote_addr zone=calibre_auth:10m rate=5r/m;

# Apply rate limiting to authentication endpoint
location /calibre/ {
    # Limit to 5 requests per minute per IP
    limit_req zone=calibre_auth burst=3 nodelay;
    
    # Only trust X-Forwarded-For from known proxies
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    real_ip_header X-Forwarded-For;
    
    proxy_pass http://localhost:8080;
}