EUVD-2026-54646Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via deep link (AV:N), no complexity beyond link crafting (AC:L), unauthenticated attacker (PR:N), single user tap required (UI:R), confidentiality limited to credential capture on the client (C:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
AnalysisAI
Open redirect in the Home Assistant Android Companion App (prior to 2026.6.1) enables credential phishing attacks against new users via crafted homeassistant://invite deep links. Because no screen in the invitation or onboarding flow displays the parsed server hostname before the WebView commits to it, an attacker who delivers a malicious invite link can silently redirect the victim's onboarding session to an attacker-controlled server presenting a look-alike login page. No public exploit code has been identified at time of analysis; the CVSS score of 4.3 (C:L) understates real-world impact given that captured credentials yield full smart-home access.
Technical ContextAI
The Home Assistant Android Companion App handles homeassistant://invite deep links via a custom URI scheme processed in LinkActivity.kt and LaunchViewModel.kt. Prior to the fix, the URL fragment embedded in the invite link was extracted and passed directly to the generic startLaunchOnboarding() function, which opened the provided server URL in a URL-bar-less onboarding WebView without any hostname validation or display. The root cause (CWE-601: URL Redirection to Untrusted Site) arises because the app trusted attacker-supplied URL data from the deep link fragment without showing it to the user. The CPE in NVD references home-assistant:core, but the actual vulnerability resides in the Android Companion App repository (github.com/home-assistant/android), not the server-side core component - a discrepancy worth verifying against vendor advisory GHSA-68f4-97mf-f68w.
RemediationAI
Upgrade the Home Assistant Android Companion App to version 2026.6.1 or later, which introduces a dedicated OpenInvitation deep link type and a new WelcomeInvitation onboarding screen that displays the parsed server URL to the user before any credentials are submitted (fix commit: https://github.com/home-assistant/android/commit/26154d923c3813cd4650e124900780f4f796d094, PR: https://github.com/home-assistant/android/pull/6955). Users who cannot immediately update should be advised never to tap homeassistant://invite links received from untrusted or unexpected sources; all invitations should be verbally confirmed with the person who sent them. Administrators sharing invite links should use out-of-band verification (voice call, in-person) to confirm the link origin with recipients. No server-side configuration change can mitigate this client-side vulnerability.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today