Homepage v2.6.0 fixes a pre-authentication bypass in its built-in login
A high-severity advisory says an unauthenticated attacker could reach the dashboard, the service and bookmark APIs and the widget proxy on Homepage 2.0.0 through 2.5.0 by supplying a Next.js internal header; 2.6.0 fixes it, and a reverse-proxy rule is the stopgap while you update.