Home-assistant vulnerabilities

6 known vulnerabilities in Home-assistant from Home-assistant. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  core: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-54317Jun 23, 2026Home-assistant

  Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not req

• 7.2 High severity

  core: Server-Side Request Forgery

  CVE-2023-41899Oct 19, 2023Home-assistant

  Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke a

• 9.6 Critical severity

  core: Improper Restriction of Rendered UI Layers or Frames

  CVE-2023-41897Oct 19, 2023Home-assistantEPSS 1.08%

  Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers fac

• 9.0 Critical severity

  core: Insufficient Verification of Data Authenticity

  CVE-2023-41896Oct 19, 2023Home-assistant

  Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state param

• 9.6 Critical severity

  core: Improper Neutralization of Input During Web Page Generation

  CVE-2023-41895Oct 19, 2023Home-assistant

  Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` v

• 10.0 Critical severity

  core: Improper Authentication

  CVE-2023-27482Mar 8, 2023Home-assistantEPSS 72.2%

  homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Sup