CVE-2026-59717 in Home Assistant
Summary
by MITRE • 08/07/2026
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects Home Assistant's Android Companion application and represents a sophisticated open redirect flaw that exploits the trust relationship between users and the onboarding process. This vulnerability specifically impacts versions prior to 2026.6.1 and demonstrates how seemingly innocuous deep link handling can be weaponized for credential theft. The issue stems from the application's failure to properly validate or display URL fragments when processing homeassistant://invite deep links, creating an attack surface that allows malicious actors to manipulate the onboarding flow without user awareness.
The technical implementation of this vulnerability relies on the Android application's improper handling of URL fragments within deep links during the invitation process. When a user receives an invite link, the application extracts the URL fragment and passes it directly into the onboarding WebView without displaying the destination hostname or performing any validation checks. This creates a scenario where the victim cannot verify the legitimacy of the target server before proceeding with authentication. The vulnerability aligns with CWE-601 Open Redirect which specifically addresses situations where applications redirect users to unverified external URLs, and it also maps to ATT&CK technique T1531 Credential Access: Use of web shell.
The operational impact of this vulnerability is particularly severe because it targets the onboarding process for new users who are inherently less likely to scrutinize the authentication flow. The attack requires only a single tap on what appears to be a legitimate connection button, making it extremely difficult to detect even by experienced users. Victims cannot distinguish between a legitimate Home Assistant server and a malicious one because no screen in the invitation or onboarding flow displays the parsed server URL before committing to the authentication process. This design flaw means that even if a user is suspicious about an invite, they have no way to verify the destination server. The attack vector exploits user trust in the application's interface and the assumption that the connection button represents a legitimate server.
The mitigation for this vulnerability involves implementing proper URL validation and display mechanisms during the onboarding process. Version 2026.6.1 addresses the issue by ensuring that URL fragments are properly validated and displayed to users before authentication begins. This fix aligns with security best practices outlined in industry standards such as OWASP Mobile Top 10 and NIST guidelines for mobile application security. The solution requires that any external URLs passed through deep links must be verified against a known good list or at minimum displayed prominently to users before proceeding with authentication. Additionally, implementing proper certificate pinning and hostname validation would further strengthen the security posture by preventing man-in-the-middle attacks that could exploit similar vulnerabilities in other parts of the application's communication stack. The fix demonstrates how simple interface design decisions can have significant security implications and underscores the importance of user verification in high-risk authentication flows where credential exposure could occur.