HomeBox implements an authentication rate limiter that counts failed attempts by client IP. The service automatically reads the X‑Real‑IP header, the first entry of X‑Forwarded‑For, and the TCP remote address, and it applies an unconditional real‑IP middleware that overwrites the remote address with the value of X‑Real‑IP. An attacker can send forged X‑Real‑IP values, causing each request to appear from a new IP and therefore get a fresh rate‑limit counter. This flaw allows an attacker to repeatedly attempt credential logins without triggering the limiter, potentially leading to unauthorized access. The weakness originates from improper restriction of operations within the limit (CWE‑307).

All editions of HomeBox released before version 0.24.0, distributed by sysadminsmedia, are affected. The vulnerability exists regardless of the configured TrustProxy option because it is never consulted by the rate‑limiting logic or the middleware. Users of HomeBox installations older than 0.24.0 should treat the product as vulnerable until an update is applied.

The CVSS score of 7.4 classifies this flaw as high severity, and the EPSS score of less than 1 % indicates a low but non‑zero probability of exploitation. The vulnerability requires remote network access, and the exploit path is straightforward: connect directly to the HomeBox service or traffic it through a proxy that injects forged X‑Real‑IP headers. Such an attack does not require privileged input or application misconfiguration beyond the ability to send HTTP requests. Because the flaw is not listed in CISA’s KEV catalog, there are currently no publicly known advanced exploits, but the high severity combined with the simplicity of the attack vector makes it a priority to mitigate immediately.