{"id":"CVE-2026-85286","kind":"vulnerability","aliases":["CVE-2026-85286"],"related":[],"title":"HomeBox: login timing lets attackers confirm registered email addresses","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.","summary":"HomeBox, a self-hosted home inventory app, answers login attempts for unknown usernames faster than for real ones because it skips the password-hash check. An unauthenticated remote attacker can use the response timing to find which email addresses have accounts.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["homebox","login","package","self-hosted"],"not_affected_if":["closed-network","version-0.27.0-or-later"],"how_to_check":"- Check the HomeBox version in use; versions before `0.27.0` are affected.\n- Look for a self-hosted HomeBox instance reachable from the internet at its login endpoint `/api/v1/users/login`.","fix":"- Move to HomeBox `0.27.0` or later.","status":"open","published_at":"2026-11-05T16:17:50+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","triaged_at":"2026-11-05T16:41:49+00:00","updated_at":"2026-11-05T16:41:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to HomeBox `0.27.0` or later.","reach":"internet","title":"HomeBox: login timing lets attackers confirm registered email addresses","impact":"low","summary":"HomeBox, a self-hosted home inventory app, answers login attempts for unknown usernames faster than for real ones because it skips the password-hash check. An unauthenticated remote attacker can use the response timing to find which email addresses have accounts.","audience":"businesses","category":"package","nicknames":[],"who_cares":["homebox","self-hosted","login"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker learns which email addresses hold accounts","analyst_note":"","how_to_check":"- Check the HomeBox version in use; versions before `0.27.0` are affected.\n- Look for a self-hosted HomeBox instance reachable from the internet at its login endpoint `/api/v1/users/login`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.27.0-or-later","closed-network"],"who_is_affected":"Teams running HomeBox before 0.27.0 with the login endpoint reachable by others, such as a shared or internet-facing instance. The impact is limited to confirming which email addresses have accounts, so private single-user instances on a closed network are lower risk. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000686,"input_tokens":4309,"output_tokens":510,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-85286':12A,15A '/api/v1/users/login':78C '0.27.0':75C,139C '401':105C 'account':64B,93C 'address':9A,62B,122C 'allow':113C 'although':99C 'answer':30B 'app':29B 'attack':5A,52B,117C 'attempt':32B,130C 'check':48B 'confirm':6A 'cve':10A,13A 'discrep':112C 'distinguish':119C 'email':8A,61B,121C 'endpoint':79C 'exist':92C 'faster':36B 'find':59B 'fix':136C 'hash':47B,83C 'home':27B,68C 'homebox':1A,16B,22B,65C 'host':21B,26B 'immedi':98C 'inventori':28B,69C 'issu':134C 'let':4A 'limit':124C 'login':2A,17B,31B 'match':90C 'number':128C 'one':40B 'organ':71C 'packag':18B 'password':46B,82C 'password-hash':45B,81C 'path':101C 'per':131C 'perform':80C 'post':77C 'prior':73C 'process':110C 'processing-tim':109C 'rate':123C 'real':39B 'reduc':126C 'regist':7A,120C 'remot':51B,116C 'respons':56B,107C 'return':97C,102C 'self':20B,25B 'self-host':19B,24B 'skip':43B 'submit':88C 'system':72C 'time':3A,57B,111C 'unauthent':50B,115C 'unauthor':106C 'unknown':34B,95C 'use':54B 'usernam':35B,89C,96C 'verif':84C 'version':138C 'window':132C","nicknames":[],"mitigations":[],"who_affected":"Teams running HomeBox before 0.27.0 with the login endpoint reachable by others, such as a shared or internet-facing instance. The impact is limited to confirming which email addresses have accounts, so private single-user instances on a closed network are lower risk. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["homebox","login","low","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-17T16:16:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85286","severity":null,"published_at":"2026-11-05T16:17:50+00:00","modified_at":"2026-11-05T16:17:50+00:00","first_seen_at":"2026-11-05T16:40:03+00:00","fetched_at":"2026-11-05T16:40:03+00:00","note":null}],"documents":[{"id":77664,"url":"https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":48316,"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77666,"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-17T16:16:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}