CVE-2026-27824

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.4.0, the calibre Content Server's brute-force protection mechanism uses a ban key derived from both `remote_addr` and the `X-Forwarded-For` header. Since the `X-Forwarded-For` header is read directly from the HTTP request without any validation or trusted-proxy configuration, an attacker can bypass IP-based bans by simply changing or adding this header, rendering the brute-force protection completely ineffective. This is particularly dangerous for calibre servers exposed to the internet, where brute-force protection is the primary defense against credential stuffing and password guessing attacks. Version 9.4.0 contains a fix for the issue.

• CWE-307
• CWE-346

• https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrwExploit, Vendor Advisory

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27819Vikunja is an open-source self-hosted task management platfo…7.2
• CVE-2026-2782Privilege escalation in the Netmonitor component. This vulne…9.8
• CVE-2026-27820zlib is a Ruby interface for the zlib compression/decompress…9.8
• CVE-2026-27821GPAC is an open-source multimedia framework. In versions up …7.8
• CVE-2026-27822RustFS is a distributed object storage system built in Rust.…5.4
• CVE-2026-27823A vulnerability has been identified in EGroupware that may l…8.7
• CVE-2026-27825MCP Atlassian is a Model Context Protocol (MCP) server for A…8
• CVE-2026-27826MCP Atlassian is a Model Context Protocol (MCP) server for A…8.2
• CVE-2026-27828EVerest is an EV charging software stack. Prior to version 2…7.5
• CVE-2026-27829Astro is a web framework. In versions 9.0.0 through 9.5.3, a…7.2
• CVE-2026-2783Information disclosure due to JIT miscompilation in the Java…7.5
• CVE-2026-27830c3p0, a JDBC Connection pooling library, is vulnerable to at…8.9