Read the docs
TI-2026-40307 Aliases CVE-2026-55844

Cleartext transmission of sensitive information in home-assistant core

Priority HIGH 72CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix Fixed core (home-assistant): 2025.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistantcorebefore 2025.5.02025.5.0Patch availableCNA
  • core Vendorhome-assistant Affected before 2025.5.0 Fixed in 2025.5.0 Patch available CNA

Remediation

  • Fix · CNA core (home-assistant) Fixed in 2025.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55844

References

Other 1

  • TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
  • TI-2021-22555 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover CVSS 4.0HIGH 8.7
  • TI-2026-61899 Home Assistant: XSS in Statistics Graph Card CVSS 4.0CRITICAL 9.3
  • TI-2026-46349 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore CVSS 4.0CRITICAL 9.3
  • TI-2025-38490 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name CVSS 4.0HIGH 8.5
  • TI-2026-25491 Home Assistant has stored XSS in history-graphs CVSS 4.0HIGH 7.3
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences