CVE-2026-59717

Received Received - Intake

Open Redirect in Home Assistant Android Companion App

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-59717

EUVD

EUVD-2026-54646

Affected Vendors & Products

Vendor	Product	Version / Range
home_assistant	android_companion_app	to 2026.6.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-939	The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Attack-Flow Graph

Executive Summary

The Home Assistant Android Companion app before version 2026.6.1 has an open redirect vulnerability. When a user receives a homeassistant://invite deep link, the app passes the URL fragment into the onboarding flow without showing the destination hostname. This allows an attacker to craft a malicious invite that redirects to a fake login page, tricking users into entering their credentials.

Detection Guidance

Check the installed version of the Home Assistant Android Companion app. If it is below 2026.6.1, the vulnerability is present. Look for unexpected login prompts or redirects during onboarding flows.

Impact Analysis

An attacker could steal your Home Assistant server credentials by sending you a malicious invite link. Since the fake login page appears in a legitimate-looking WebView, you might not notice the substitution. This could lead to unauthorized access to your home automation system and data.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by exposing user credentials through a phishing attack. An attacker could capture login details via a malicious login page, risking unauthorized access to sensitive home automation data or personal information.

Mitigation Strategies

Update the Home Assistant Android Companion app to version 2026.6.1 or later. Avoid using invitation links from untrusted sources and verify server URLs before entering credentials.

Hi! I’m here to help you understand CVE-2026-59717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70