Advisories · Technology

home-assistant core.

Every CVE that names home-assistant core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-66061 CVE record

CVSS 7.1 High

Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
- home-assistant core
- Broken access control
Not analysed yet 7 Aug 2026
CVE-2026-66060 CVE record

CVSS 7.1 High

Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
- home-assistant core
- Broken access control
Not analysed yet 7 Aug 2026
CVE-2026-59717 CVE record

CVSS 4.3 Medium

Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
- home-assistant core
- Open redirect
- CWE-939
Not analysed yet 7 Aug 2026
CVE-2026-55844 CVE record

CVSS 7.5 High

Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
- home-assistant core
- Weak cryptography or TLS
Not analysed yet 29 Jun 2026
CVE-2026-54318 CVE record

CVSS 7.1 High

Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
- home-assistant core
- CWE-926
Not analysed yet 23 Jun 2026
CVE-2026-44698 CVE record

CVSS 8.3 High

Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection
- home-assistant core
- Home Assistant Companion app (iOS)
- Code injection
- CWE-346
Not analysed yet 29 May 2026
CVE-2023-41894 CVE record

CVSS 5.3 Medium

Local-only webhooks externally accessible via SniTun in Home Assistant Core
- home-assistant core
- CWE-669
Not analysed yet 19 Oct 2023
CVE-2023-41895 CVE record

CVSS 8.8 High

Cross-site Scripting via auth_callback login in Home Assistant Core
- home-assistant core
- Cross-site scripting (XSS)
Not analysed yet 19 Oct 2023
CVE-2023-41896 CVE record

CVSS 7.1 High

Fake websocket server installation permits full takeover in Home Assistant Core
- home-assistant core
- CWE-345
Not analysed yet 19 Oct 2023
CVE-2023-41897 CVE record

CVSS 8.8 High

Lack of XFO header allows clickjacking in Home Assistant Core
- home-assistant core
- CWE-1021
Not analysed yet 19 Oct 2023
CVE-2023-41899 CVE record

CVSS 6.6 Medium

Partial Server-Side Request Forgery in Home Assistant Core
- home-assistant core
- Server-side request forgery (SSRF)
Not analysed yet 19 Oct 2023
CVE-2023-41898 CVE record

CVSS 8.6 High

Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android
- home-assistant core
- Code injection
- CWE-345
Not analysed yet 19 Oct 2023
CVE-2023-44385 CVE record

CVSS 8.6 High

Client-Side Request Forgery in Home Assistant iOS/macOS native Apps
- home-assistant core
- Cross-site request forgery (CSRF)
Not analysed yet 19 Oct 2023
CVE-2023-27482 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Improper authentication in home-assistant core and others
- home-assistant core
- home-assistant supervisor
- Authentication bypass
Not analysed yet 8 Mar 2023