Home-assistant-js-websocket vulnerabilities
1 known vulnerability in Home-assistant-js-websocket from Home-assistant. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
1critical
0high
0exploited
9.0average CVSS score
Latest first
- 9.0 Critical severity
core: Insufficient Verification of Data Authenticity
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state param