{"affected":[{"product":"homebox","source":"CNA: GitHub_M","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.27.0"}]}],"cveId":"CVE-2026-85286","cwes":["CWE-204","CWE-208"],"description":"HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return immediately. Although both paths return the same 401 unauthorized response, the processing-time discrepancy allows an unauthenticated remote attacker to distinguish registered email addresses; rate limiting only reduces the number of attempts per window. This issue is fixed in version 0.27.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.7,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793894512991,"publishedAt":1793894512991,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sysadminsmedia/homebox/commit/66809ce3583cbd0b43e8f5ce30cc269a1cfe4201"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0"}],"remediation":[],"revision":"cf2bb5da613ca7c96df4af33757e8efbb21f81d5ad2535b08e3a3470d2df1e72","sources":[{"modifiedAt":1793894512991,"name":"CNA: GitHub_M","retrievedAt":1793895391235,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85286"}],"ssvc":null,"status":"published","title":"HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay","updatedAt":1793895391235}