CVE-2026-85286

The HomeBox home inventory system is vulnerable to a timing side-channel in the POST /api/v1/users/login endpoint prior to version 0.27.0 . The application performs password-hash verification only for registered usernames, while returning immediately for unknown ones. This processing-time discrep...