CVE-2026-66061

Received Received - Intake

Home Assistant iOS App NFC Tag Link Spoofing

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-66061

Affected Vendors & Products

Vendor	Product	Version / Range
home_assistant	ios_companion_app	to 2026.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The vulnerability in Home Assistant's iOS Companion app before version 2026.5.0 allows any untrusted app on the device to forward an arbitrary NFC or QR tag link to Home Assistant via iOS universal links. The app executes the associated automation as if a legitimate user scanned an authorized tag, enabling silent automation execution without user validation.

Detection Guidance

Check the version of your Home Assistant iOS Companion app. If it is below 2026.5.0, the vulnerability is present. Update to version 2026.5.0 or later to address it.

Impact Analysis

This vulnerability allows unauthorized apps to trigger Home Assistant automations without user interaction or permission. Attackers could silently activate devices or services linked to Home Assistant, potentially causing unintended actions like unlocking doors, disabling alarms, or controlling smart home devices without your knowledge.

Compliance Impact

This vulnerability could potentially violate privacy-focused regulations like GDPR by allowing unauthorized automation execution without user interaction. It may also compromise data integrity if malicious actions are performed under the guise of legitimate user actions.

Mitigation Strategies

Update the Home Assistant iOS Companion app to version 2026.5.0 or later to fix the vulnerability. No additional commands are required for mitigation.

Hi! I’m here to help you understand CVE-2026-66061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70