Skip to content
OpenAdvisories

Vendor

homeassistant-ai

2 known vulnerabilities.

Products

ha-mcp 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-32112

    ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

    ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a craft…

    homeassistant-ai ha-mcp ha-mcp PyPI
  • Medium 5.3
    CVE-2026-32111

    ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

    ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no URL validation. An unauthenticated attacker can submit arbit…

    homeassistant-ai ha-mcp ha-mcp PyPI