diff --git a/lib/vagrant/action/builtin/box_add.rb b/lib/vagrant/action/builtin/box_add.rb
index d1ee6c2b5..2483aa65e 100644
--- a/lib/vagrant/action/builtin/box_add.rb
+++ b/lib/vagrant/action/builtin/box_add.rb
@@ -60,7 +60,7 @@ module Vagrant
           # Call the hook to transform URLs into authenticated URLs.
           # In the case we don't have a plugin that does this, then it
           # will just return the same URLs.
-          hook_env    = env[:hook].call(:authenticate_box_url, box_urls: url)
+          hook_env    = env[:hook].call(:authenticate_box_url, box_urls: url.dup)
           authed_urls = hook_env[:box_urls]
           if !authed_urls || authed_urls.length != url.length
             raise "Bad box authentication hook, did not generate proper results."