CVE-2026-27824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27824", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:32:39.799Z", "datePublished": "2026-02-27T19:46:07.612Z", "dateUpdated": "2026-03-02T12:54:32.182Z"}, "containers": {"cna": {"title": "calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw"}], "affected": [{"vendor": "kovidgoyal", "product": "calibre", "versions": [{"version": "< 9.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:46:07.612Z"}, "descriptions": [{"lang": "en", "value": "calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue."}], "source": {"advisory": "GHSA-vhxc-r7v8-2xrw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-02T12:54:19.314863Z", "id": "CVE-2026-27824", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T12:54:32.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27824", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-02T12:54:19.314863Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-02T12:54:28.301Z"}}], "cna": {"title": "calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing", "source": {"advisory": "GHSA-vhxc-r7v8-2xrw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "kovidgoyal", "product": "calibre", "versions": [{"status": "affected", "version": "< 9.4.0"}]}], "references": [{"url": "https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw", "name": "https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-27T19:46:07.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27824", "state": "PUBLISHED", "dateUpdated": "2026-03-02T12:54:32.182Z", "dateReserved": "2026-02-24T02:32:39.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-27T19:46:07.612Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "calibre", "vendor": "kovidgoyal", "versions": [{"status": "affected", "version": "< 9.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*", "matchCriteriaId": "3665E54E-5F8D-405A-BA97-8DD783962094", "versionEndExcluding": "9.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue."}, {"lang": "es", "value": "calibre es un gestor de libros electr\u00f3nicos multiplataforma para ver, convertir, editar y catalogar libros electr\u00f3nicos. Antes de la versi\u00f3n 9.4.0, el mecanismo de protecci\u00f3n contra fuerza bruta del servidor de contenido de calibre utiliza una clave de prohibici\u00f3n derivada tanto de 'remote_addr' como del encabezado 'X-Forwarded-For'. Dado que el encabezado 'X-Forwarded-For' se lee directamente de la solicitud HTTP sin ninguna validaci\u00f3n o configuraci\u00f3n de proxy de confianza, un atacante puede eludir las prohibiciones basadas en IP simplemente cambiando o a\u00f1adiendo este encabezado, lo que hace que la protecci\u00f3n contra fuerza bruta sea completamente ineficaz. Esto es particularmente peligroso para los servidores de calibre expuestos a internet, donde la protecci\u00f3n contra fuerza bruta es la defensa principal contra ataques de relleno de credenciales y adivinaci\u00f3n de contrase\u00f1as. La versi\u00f3n 9.4.0 contiene una soluci\u00f3n para el problema."}], "id": "CVE-2026-27824", "lastModified": "2026-06-17T10:27:44.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27824", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-02T12:54:19.314863Z", "version": "2.0.3"}}]}, "published": "2026-02-27T20:21:39.973", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,9.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "calibre", "source": "cna", "vendor": "kovidgoyal"}, "product": "calibre", "vendor": "kovidgoyal"}], "analysis": {"en": {"generated_at": "2026-04-16T15:19:55.362612+00:00", "value": {"mitigation_remediation": ["Upgrade calibre to version\u202f9.4.0 or newer to apply the vendor fix.", "If an upgrade cannot be performed immediately, configure the content server to trust only known reverse proxies and validate or strip the X\u2011Forwarded\u2011For header from untrusted requests.", "Implement additional authentication controls such as rate limiting or two\u2011factor authentication to mitigate credential\u2011guessing during the remediation window."], "summary": {"action": "Patch", "impact": "Bypass of IP\u2013based brute\u2011force protection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the calibre e\u2011book manager (vendor kovidgoyal) and applies to all releases older than version\u202f9.4.0. Targeted systems are servers running calibre\u2019s content server that are exposed to the Internet.", "description_and_impact": "This flaw allows an attacker to subvert calibre\u2019s content\u2011server login protection by injecting a forged X\u2011Forwarded\u2011For header. Because the header is accepted without validation, the ban key that should block repeated login attempts does not change when the apparent IP address changes, thus disabling the protection. The issue aligns with CWE\u2011307 and CWE\u2011346 and carries a CVSS base score of 5.3, indicating a moderate risk that could lead to credential compromise if left unaddressed.", "risk_and_exploitability": "With an EPSS score below 1\u202f% the statewide likelihood of exploitation is low, yet the flaw is directly exploitable by any remote user simply by altering an HTTP header. The vulnerability is not listed in CISA\u2019s KEV catalog, but attackers can repeatedly attempt password stuffing once a ban is triggered, making it particularly dangerous for publicly reachable calibre servers."}}}}, "created": "2026-03-02T12:05:05.525922+00:00", "updated": "2026-04-16T15:30:06.215045+00:00", "vendors": ["kovidgoyal", "kovidgoyal$PRODUCT$calibre"]}