CVE-2026-85286: HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can probe the login endpoint and use response-time differences to determine whether submitted email addresses belong to registered accounts.
Does rate limiting prevent user enumeration?
No. Rate limiting reduces the number of login attempts an attacker can make during a given window, but it does not eliminate the timing difference between existing and unknown usernames.
What versions should be remediated?
HomeBox versions prior to 0.27.0 are affected. Upgrade to version 0.27.0, which fixes the issue.
How can I tell whether an instance is vulnerable?
An instance is vulnerable if it runs a version earlier than 0.27.0 and exposes POST /api/v1/users/login. The observable condition is that login attempts for existing accounts take longer than attempts for unknown usernames, despite both returning HTTP 401.