CVE-2026-55844
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk6th percentile — higher than 6% of all known CVEs
Summary
The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.
Risk Assessment
The risk involves potential leakage of the authentication token, which could allow unauthorized access to the Home Assistant instance and control over the smart home.
Recommendation
It is recommended to immediately update the Home Assistant iOS companion app to version 2025.5.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.