From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Tue, 24 Feb 2026 16:53:46 +0530
Subject: CVE-2026-27824: Content server: When banning IPs for repeated login
 is enabled, only use the IP address not any HTTP headers as the ban key

Forwarded: not-needed
Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-vhxc-r7v8-2xrw
Origin: https://github.com/kovidgoyal/calibre/commit/2f273444460d06f72f7a8f390f5f9ff325d1f836

This means banning is ineffective behind a proxy, but cant be helped
since we have no way of authenticating that a header comes from the
proxy.

Signed-off-by: YOKOTA Hiroshi <yokota.hgml@gmail.com>
---
 src/calibre/srv/auth.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/calibre/srv/auth.py b/src/calibre/srv/auth.py
index 8396316..ea9d503 100644
--- a/src/calibre/srv/auth.py
+++ b/src/calibre/srv/auth.py
@@ -270,9 +270,9 @@ class AuthController:
         return cookie and validate_nonce(self.key_order, cookie, path, self.secret) and not is_nonce_stale(cookie, self.max_age_seconds)
 
     def do_http_auth(self, data, endpoint):
-        ban_key = data.remote_addr, data.forwarded_for
+        ban_key = data.remote_addr
         if self.ban_list.is_banned(ban_key):
-            raise HTTPForbidden('Too many login attempts', log='Too many login attempts from: %s' % (ban_key if data.forwarded_for else data.remote_addr))
+            raise HTTPForbidden('Too many login attempts', log=f'Too many login attempts from: {data.remote_addr}')
         auth = data.inheaders.get('Authorization')
         nonce_is_stale = False
         log_msg = None
