A critical authentication bypass vulnerability in HomeBox allows unauthenticated attackers to circumvent rate limiting, facilitating brute-force attacks against user accounts.

The application incorrectly handles HTTP headers used to identify client IP addresses, allowing an unauthenticated attacker to supply arbitrary values in the X-Real-IP header. This effectively resets the rate limiter for every request, permitting an unlimited number of login attempts.

The ability to bypass rate limiting significantly increases the risk of successful credential stuffing or brute-force attacks against administrative and user accounts. Given the CVSS score of 7.4, this vulnerability poses a high risk to data confidentiality and integrity, potentially leading to unauthorized access to sensitive home inventory data and system compromise.

Immediate Action: Upgrade to HomeBox version 0.24.0 or later, which correctly addresses the rate limiter configuration and header processing logic.

Proactive Monitoring: Review authentication logs for an unusual volume of login attempts from single or rapidly rotating IP addresses that may indicate an ongoing brute-force attempt.

Compensating Controls: If immediate patching is not feasible, implement strict ingress filtering at the network edge to strip untrusted X-Real-IP or X-Forwarded-For headers before they reach the application.

Public Exploit Available: No (exploit_available unknown).

This vulnerability represents a significant security oversight in the authentication pipeline of HomeBox. Because the rate limiting mechanism can be trivially bypassed, the risk of automated password guessing is high. Administrators should prioritize the update to version 0.24.0 to ensure the application correctly validates client sources and enforces security policies.