What is the CVSS score of CVE-2026-55844?

CVE-2026-55844 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Home Assistant are affected by CVE-2026-55844?

Home Assistant iOS app versions prior to 2025.5.0 expose authentication tokens on untrusted Wi-Fi networks due to misconfigured network allowlisting, potentially granting attackers unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-55844?

24 hours: Identify iOS Home Assistant users in your environment and assess their connection patterns to untrusted networks; note that no public exploit has been identified at this time. 7 days: Deploy Home Assistant iOS companion app version 2025.5.0 or later to all affected devices through mobile device management. 30 days: Verify patch deployment across all iOS installations and audit authentication logs for unauthorized access attempts.

Home Assistant CVE-2026-55844

EUVD-2026-40119 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-29 GitHub_M

Information Disclosure Apple Core Home Assistant

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Token interception requires an attacker on the victim's insecure network (AV:A) and the non-default no-other-URL fallback condition (AC:H); impact is confidentiality-only token disclosure (C:H, I/A:N).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 29, 2026 - 16:01 EUVD

Analysis Generated

Jun 29, 2026 - 15:19 vuln.today

CVE Published

Jun 29, 2026 - 14:19 cve.org

HIGH 7.5

DescriptionCVE.org

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.

AnalysisAI

Sensitive token disclosure affects the Home Assistant iOS companion app prior to 2025.5.0, where the app ignores the configured SSID allowlist meant to gate internal-network access. Because the app falls back to the internal URL whenever no other URL is available, it can transmit the user's authentication token to the internal endpoint while the device is connected to an untrusted or insecure Wi-Fi network, enabling interception. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; vendor advisory GHSA-cm5v-547m-qh5h confirms the fix in 2025.5.0.

Technical ContextAI

Home Assistant is an open-source home automation platform; its iOS companion app connects to either an internal URL (for the local network) or an external URL (for remote access). The app uses the connected Wi-Fi SSID, checked against a user-defined allowlist, to decide when the internal URL is appropriate. The root cause maps to CWE-319 (Cleartext/Insecure Transmission of Sensitive Information): a logic gap in the URL-selection routine causes the app to disregard the SSID allowlist and default to the internal URL when no other URL resolves, so the bearer token used for API authentication is sent to an endpoint reachable over whatever (possibly attacker-controlled or eavesdroppable) network the device is on. The CPE provided (cpe:2.3:a:home-assistant:core:*) references Home Assistant Core, but the description and advisory scope the defect to the iOS companion app specifically - a notable source discrepancy.

RemediationAI

Vendor-released patch: 2025.5.0 - upgrade the Home Assistant iOS companion app to 2025.5.0 or later, per advisory GHSA-cm5v-547m-qh5h (https://github.com/home-assistant/core/security/advisories/GHSA-cm5v-547m-qh5h). Until updated, avoid connecting the device to untrusted or open Wi-Fi networks where the app might fall back to the internal URL (trade-off: limits mobility/remote use), and ensure a valid external URL is configured so the app is never forced into the internal-URL fallback. As defense against cleartext token exposure, serve the internal endpoint over HTTPS/TLS and consider rotating long-lived access tokens issued to the iOS app after upgrading, since a token exposed pre-patch could remain valid (trade-off: requires re-authenticating the app).