Vulnerability details
CVE-2026-55844
home-assistant core
Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data
CVSS 3.1
7.5High
Official description
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| home-assistant | core | < 2025.5.0 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/home-assistant/core/security/advisories/GHSA-cm5v-547m-qh5h x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-29
- Last updated
- 2026-06-30
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.2%
Probability of exploitation in 30 days
9.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-319Cleartext Transmission of Sensitive Information