{"id":"CVE-2026-85286","aliases":[],"cve":{"records":[{"id":"CVE-2026-85286","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-03T16:37:49.262Z","published":"2026-11-05T16:01:52.991Z","modified":"2026-11-09T16:51:32.074Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-05T16:01:52.991Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T16:51:32.074Z"}],"references":[{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-204","description":"CWE-204: Observable Response Discrepancy","source":"GitHub_M"},{"id":"CWE-208","description":"CWE-208: Observable Timing Discrepancy","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T16:10:15.229504Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.","score":3.7,"severity":"low","published":"2026-11-05T16:01:52.991Z","modified":"2026-11-09T16:51:32.074Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"sysadminsmedia","name":"homebox","platforms":[],"versions":[{"version":"< 0.27.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-85286"}],"remediation":[],"references":["https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm","https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201","https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"],"sources":[{"name":"CVE","id":"CVE-2026-85286","modified":"2026-11-09T16:51:32.074Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-85286"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7}],"sourceAffected":[],"observedAt":"2026-11-09T17:02:03.652Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T18:50:33.466Z","attemptedAt":"2026-11-05T18:50:33.466Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-05T18:50:32.408Z","attemptedAt":"2026-11-05T18:50:32.408Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T18:50:33.466Z","attemptedAt":"2026-11-05T18:50:33.466Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T18:50:33.466Z","attemptedAt":"2026-11-05T18:50:33.466Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-85286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85286","modified":"2026-11-05T16:17:50.463","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-05T18:50:33.466Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117559","modified":"Nov 5, 2026, 4:01:52 PM","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-05T18:50:33.466Z"}],"aiSummary":{"text":"HomeBox, a home inventory system, has a timing side-channel vulnerability in its login endpoint, affecting versions prior to 0.27.0. An unauthenticated remote attacker can enumerate user accounts by measuring the delay in bcrypt hashing. The issue allows distinguishing registered email addresses despite returning the same 401 response.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T18:06:08.240Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-85286"}]}}