CVE-2026-59717 Details
Description
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
A vulnerability in the Home Assistant Android Companion app, prior to version 2026.6.1, allows for open redirection and credential phishing. The issue arises when the app processes deep links containing server URLs, specifically through the 'homeassistant://invite' scheme. During the onboarding process, the app fails to display the destination server URL, leaving users unaware of which server they are connecting to. This lack of transparency enables attackers to craft invitations that redirect users to malicious servers, where they can intercept login credentials. The vulnerability is particularly concerning as it targets new users who may not recognize the deception.
Users can update the Home Assistant Android Companion app to version 2026.6.1 or later, where this vulnerability has been fixed. Instructions for updating the app can be found on the Google Play Store.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/home-assistant/core/security/advisories/GHSA-68f4-97mf-f68w | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/home-assistant/android/commit/26154d923c3813cd4650e124900780f4f796d094 | [email protected] | Source CodeVendor |
| https://github.com/home-assistant/android/pull/6955 | [email protected] | Issue TrackingVendor |
| https://github.com/home-assistant/core/security/advisories/GHSA-68f4-97mf-f68w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Home Assistant | All versions |
CPE
Remediation
| |
| Home Assistant Companion | <= 2026.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | New CVE Received | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |