CVE-2026-55844
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.
Risk Assessment
The risk involves potential leakage of the authentication token, which could allow unauthorized access to the Home Assistant instance and control over the smart home.
Recommendation
It is recommended to immediately update the Home Assistant iOS companion app to version 2025.5.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Home Assistant
See all- CVE-2026-66061High
Prior to version 2026.5.0, the Home Assistant Companion app for iOS treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
- CVE-2026-66060High
Prior to version 2026.5.3, the Home Assistant Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
- CVE-2026-59717Medium
Home Assistant before version 2026.6.1 has an open redirect vulnerability in the Android Companion app. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft an invite that leads to a look-alike login page capturing credentials.
Original NVD description (English source)
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.