CVE-2026-85286: low-severity vulnerability in sysadminsmedia homebox
HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
5Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.7
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
sysadminsmedia · homeboxRelated CVEs — sysadminsmedia homebox
In the same product, most dangerous first.
CVE-2026-48826HIGHHomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header SwitchingEPSS 0.5%CVE-2026-48975HIGHHomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in HomeboxEPSS 0.5%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.4%CVE-2026-55473MEDIUMHomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egressEPSS 0.4%CVE-2025-53108MEDIUMHomeBox Missing User AuthorizationEPSS 0.3%CVE-2026-27981HIGHHomeBox has an Auth Rate Limit Bypass via IP SpoofingEPSS 0.3%