Govee vulnerabilities
We track 4 vulnerabilities in Govee products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 18, 2025.
Latest Govee vulnerabilities
- 9.3 Critical severity
H6056: Authorization Bypass Through User-Controlled Key
A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s accou
- 10.0 Critical severity
Govee Home: Incorrect Authorization
Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applicat
- 7.5 High severity
Mini Smart Wi-fi Plug Firmware: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allo
- 8.8 High severity
Govee Home: Exposed Dangerous Method or Function
Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishin