CVE-2026-27981: Homebox Auth Bypass Vulnerability

CVE-2026-27981 Overview

HomeBox, a home inventory and organization system developed by sysadminsmedia, contains a critical authentication rate limiter bypass vulnerability. Prior to version 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP but can be trivially bypassed through IP header forgery. The system determines the client IP by reading the X-Real-IP header, the first entry of the X-Forwarded-For header, or the r.RemoteAddr TCP connection address—all without proper validation.

Critical Impact

An attacker connecting directly to HomeBox can forge the X-Real-IP header value to obtain a fresh rate limit identity per request, effectively bypassing brute-force protection and enabling credential-based attacks.

Affected Products

• sysadminsmedia homebox versions prior to 0.24.0

Discovery Timeline

• 2026-03-03 - CVE-2026-27981 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27981

Vulnerability Analysis

This vulnerability represents a classic Improper Restriction of Excessive Authentication Attempts (CWE-307) flaw combined with a trust boundary violation. The authentication rate limiter was designed to prevent brute-force attacks by tracking failed login attempts per client IP address. However, the implementation unconditionally trusts client-supplied IP headers without validating whether the request originates from a trusted proxy.

The core issue stems from two architectural problems. First, the TrustProxy configuration option (Options.TrustProxy, which defaults to false) was never actually read by any middleware or rate limiter code—rendering it functionally useless. Second, the chi framework's middleware.RealIP was applied unconditionally in main.go, which overwrites r.RemoteAddr with the forged header value before requests reach any handler.

Root Cause

The root cause is the unconditional trust of IP-identifying HTTP headers combined with an unused configuration option. When an attacker connects directly to HomeBox (not through a reverse proxy), they can supply arbitrary values in the X-Real-IP or X-Forwarded-For headers. Since the TrustProxy configuration was never implemented in the middleware chain, these headers are always trusted regardless of the configuration setting. The chi middleware.RealIP middleware exacerbates this by modifying r.RemoteAddr directly, meaning even code that attempts to use the TCP connection address receives the forged value instead.

Attack Vector

The attack can be executed remotely over the network by any unauthenticated attacker with direct access to the HomeBox instance. The attacker simply needs to rotate the X-Real-IP header value with each authentication attempt. By using unique, randomly generated IP addresses in the header, the attacker can make unlimited authentication attempts without triggering rate limiting, enabling brute-force and credential stuffing attacks against user accounts.

Detection Methods for CVE-2026-27981

Indicators of Compromise

• Multiple failed authentication attempts from the same source IP but with varying X-Real-IP or X-Forwarded-For header values
• Unusual patterns of authentication failures that don't trigger rate limiting alerts
• High volumes of login attempts to HomeBox instances that appear to come from many different IPs at the network layer

Detection Strategies

• Monitor web server access logs for requests containing inconsistent X-Real-IP headers that don't match the actual client connection IP
• Implement application-level logging that captures both the TCP source address and any IP-related HTTP headers for correlation
• Deploy a Web Application Firewall (WAF) configured to detect and alert on header manipulation patterns

Monitoring Recommendations

• Enable verbose authentication logging in HomeBox to track all login attempts with full request details
• Compare network-layer source IPs with application-layer reported IPs to identify header forgery attempts
• Set up alerts for authentication failures that exceed normal thresholds but don't trigger the application's rate limiter

How to Mitigate CVE-2026-27981

Immediate Actions Required

• Upgrade HomeBox to version 0.24.0 or later immediately
• If running HomeBox behind a reverse proxy, ensure the proxy strips or overwrites client-supplied X-Real-IP and X-Forwarded-For headers
• Restrict direct network access to HomeBox instances by placing them behind a properly configured reverse proxy

Patch Information

The vulnerability is fixed in HomeBox version 0.24.0. The fix properly implements the TrustProxy configuration option so that IP-identifying headers are only trusted when the instance is configured to run behind a trusted proxy. Users should update to the latest version immediately. For detailed information about the security fix, see the GitHub Security Advisory.

Workarounds

• Deploy HomeBox behind a reverse proxy (such as nginx, Traefik, or Caddy) that strips or normalizes the X-Real-IP and X-Forwarded-For headers before forwarding requests
• Implement network-level rate limiting at the reverse proxy or firewall level based on true client IP addresses
• Restrict network access to HomeBox using firewall rules to prevent direct connections from untrusted networks