CVE-2026-66061 in Home Assistant
Summary
by MITRE • 08/07/2026
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical authorization bypass flaw in Home Assistant's iOS Companion application that undermines the security model designed to protect home automation systems. The issue stems from improper validation of tag link sources within the OS-level routing mechanism, specifically affecting how iOS universal links are processed when delivered through NFC or QR code interactions. The vulnerability exists because the application treats all incoming tag links equally regardless of their source, creating an attack surface where malicious applications can exploit the trust relationship between the operating system and Home Assistant.
The technical implementation flaw occurs within the iOS Companion app's handling of external URI schemes and universal link routing mechanisms. When a tag link is delivered through iOS's universal linking system, the application fails to verify the authenticity of the calling application or validate that the link originated from a legitimate source. This creates a scenario where any application with sufficient privileges on the device can craft and forward arbitrary tag links to Home Assistant, effectively bypassing the intended security controls that should require user confirmation or authentication before executing automations. The vulnerability is particularly dangerous because it operates entirely within the local device environment without requiring network access or external attack vectors.
The operational impact of this vulnerability extends beyond simple unauthorized automation execution, creating a potential pathway for malicious actors to compromise entire home automation ecosystems. An attacker with access to an infected device could silently trigger sensitive automations such as door lock operations, lighting control, security system arming, or other critical functions without user knowledge or consent. This represents a significant violation of the principle of least privilege and undermines the privacy assurances that users expect from local home automation systems. The vulnerability affects any Home Assistant installation running iOS Companion app versions prior to 2026.5.0, potentially exposing thousands of home networks to unauthorized control.
This issue aligns with several cybersecurity frameworks including CWE-863 (Incorrect Authorization) and represents a clear violation of the ATT&CK technique T1059.001 (Command and Scripting Interpreter) through legitimate application interfaces. The vulnerability demonstrates poor input validation and insufficient source verification mechanisms that should be implemented at the application boundary level. The fix implemented in version 2026.5.0 addresses this by introducing proper caller authentication and user prompt mechanisms when processing external tag links, ensuring that only trusted applications can trigger automation execution. Organizations should immediately update to the patched version and review their device security configurations to prevent unauthorized applications from gaining control over critical home automation functions.
The broader implications of this vulnerability highlight the importance of secure inter-application communication patterns in mobile environments where local trust relationships can be exploited for privilege escalation attacks. This represents a classic example of how operating system-level routing mechanisms, when not properly secured, can create attack vectors that bypass application-layer security controls. The vulnerability serves as a reminder that even locally hosted systems must implement proper source verification and user consent mechanisms, particularly when dealing with automated actions that have physical world consequences. Security practitioners should consider this issue when evaluating mobile application security postures and implementing device access control policies for home automation environments.