CVE-2026-85286Low· 3.7▾ SunlitHomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.
homebox < 0.27.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85287Medium· 6.5HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
CVE-2026-75599Medium· 5.4HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
CVE-2026-116680Medium· 6.4Homebox generic notifier SSRF via HTTP redirect after URL validation
CVE-2026-55473Medium· 6.0HomeBox is a home inventory and organization system
CVE-2026-48826High· 8.1HomeBox is a home inventory and organization system
CVE-2026-48976High· 8.1HomeBox is a home inventory and organization system