Skip to content
OpenAdvisories

Vendor

home-assistant

28 known vulnerabilities.

Products

core 23 Home Assistant Core 3 supervisor 1 Companion app (iOS) 1 Companion app (Android) 1 Home Assistant Operating System 1 Home Assistant Supervisor 1 Home Assistant Community Store (HACS) 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-91129

    Home Assistant: mDNS Server-Side Request Forgery

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, wher…

    home-assistant core homeassistant PyPI
  • Medium 4.3
    CVE-2026-59717

    Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboa…

    home-assistant core
  • Medium 4.7
    CVE-2026-64823

    Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

    Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data UR…

    home-assistant Home Assistant Core
  • Medium 4.3
    CVE-2023-50715

    User accounts disclosed to unauthenticated actors on the LAN

    Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this is…

    home-assistant core homeassistant PyPI
  • Medium 4.3
    CVE-2023-41893

    Account takeover via auth_callback login in Home Assistant Core

    Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent…

    home-assistant core homeassistant PyPI
  • Medium 5.3
    CVE-2023-41894

    Local-only webhooks externally accessible via SniTun in Home Assistant Core

    Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local n…

    home-assistant core
  • Medium 6.6
    CVE-2023-41899

    Partial Server-Side Request Forgery in Home Assistant Core

    Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke …

    home-assistant core