CVE-2026-27824: 
NixOS vulnerability analysis and mitigation

CVE-2026-27824 is an IP ban bypass vulnerability in the calibre Content Server's brute-force protection mechanism, caused by unsanitized use of the X-Forwarded-For HTTP header. An unauthenticated remote attacker can spoof this header to generate unique ban keys, effectively circumventing IP-based rate limiting and enabling unlimited credential stuffing or password guessing attacks. All calibre versions up to and including 9.3.1 are affected; version 9.4.0 contains the fix. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and CWE-346 (Origin Validation Error). In src/calibre/srv/http_request.py (line 343), the X-Forwarded-For header is read unconditionally from the HTTP request with no trusted-proxy validation: self.forwarded_for = inheaders.get('X-Forwarded-For'). The ban key in src/calibre/srv/auth.py (lines 270–273) is constructed as a tuple (remote_addr, forwarded_for), meaning that rotating the X-Forwarded-For value on each request produces a distinct, unbanned key — e.g., (127.0.0.1, None), (127.0.0.1, "10.0.0.1"), (127.0.0.1, "10.0.0.2") are all treated as separate identities. A public proof-of-concept demonstrating both manual bypass and automated brute-force scripting is included in the security advisory (GitHub Advisory).

Successful exploitation renders the --ban-after and --ban-for brute-force protection options completely ineffective, allowing an attacker to make unlimited login attempts against any user account on an internet-exposed calibre Content Server. This enables credential stuffing, password guessing, and potential username enumeration through response-code differences, all without being rate-limited or banned. The primary confidentiality risk is unauthorized access to a user's e-book library and any sensitive content stored or accessible through the server (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, including a ready-to-use bash script for automated brute-forcing with rotating X-Forwarded-For values. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.014% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing calibre Content Servers (default port 8080 or 8091) using tools like Shodan or Censys, confirming authentication is enabled by observing HTTP 401 responses.
2. Trigger initial ban: Send three failed login attempts to confirm the ban mechanism is active (HTTP 403 response on the fourth attempt).
3. Bypass the ban: Add an arbitrary X-Forwarded-For header (e.g., X-Forwarded-For: 10.10.10.10) to the next request. The server generates a new ban key and lifts the block, returning HTTP 200 on valid credentials.
4. Automate brute-force: Use a script that increments the X-Forwarded-For value on each attempt (e.g., 10.0.0.1, 10.0.0.2, ...) while iterating through a password wordlist, effectively making unlimited attempts without ever being banned.
5. Achieve account compromise: Upon receiving an HTTP 200 response, the correct password has been found; the attacker can now authenticate to the calibre Content Server and access the user's library and data (GitHub Advisory).

• Network: High volume of HTTP authentication requests (401/403 responses) to the calibre Content Server from a single IP address, each with a different X-Forwarded-For header value; sequential or patterned fake IP addresses in the X-Forwarded-For field (e.g., 10.0.0.1, 10.0.0.2, ...).
• Logs: Calibre server access logs showing repeated failed login attempts (Failed login attempt from:) with varying forwarded_for values but the same remote_addr; sudden successful authentication following a series of failures from the same source IP.
• Process/Behavior: Unusual spike in authentication events in a short time window; the --ban-after threshold being reached repeatedly without sustained 403 responses from the same source IP (GitHub Advisory).

Upgrade calibre to version 9.4.0 or later, which contains the official fix for this vulnerability (GitHub Advisory). For systems that cannot be immediately patched, restrict access to the calibre Content Server to trusted internal networks only using firewall rules, and implement network-level rate limiting (e.g., via a reverse proxy such as nginx or fail2ban) that is independent of the application's IP-ban mechanism. If a reverse proxy is in use, configure it to strip or overwrite the X-Forwarded-For header before forwarding requests to calibre.

The vulnerability was reported by researcher dxlerYT and published by the calibre maintainer kovidgoyal as a GitHub Security Advisory on February 27, 2026. The issue was rated Moderate severity. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database aggregation (GitHub Advisory).