CVE-2026-66060
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Prior to version 2026.5.3, the Home Assistant Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
Risk Assessment
An untrusted app on the user's device can execute automations in Home Assistant without the user's knowledge or consent, potentially leading to unauthorized actions such as opening doors or disabling alarms.
Recommendation
Update the Home Assistant Companion app to version 2026.8.1 or later to remediate the vulnerability.
Other vulnerabilities in Home Assistant
See all- CVE-2026-66061High
Prior to version 2026.5.0, the Home Assistant Companion app for iOS treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
- CVE-2026-59717Medium
Home Assistant before version 2026.6.1 has an open redirect vulnerability in the Android Companion app. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft an invite that leads to a look-alike login page capturing credentials.
- CVE-2026-55844High
The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.
Original NVD description (English source)
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.