What is the CVSS score of CVE-2026-66061?

CVE-2026-66061 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Home Assistant iOS are affected by CVE-2026-66061?

Home Assistant iOS Companion app versions prior to 2026.5.0 allow any co-installed untrusted application to silently trigger home automations without physical validation, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-66061?

Within 24 hours, identify all users with iOS Companion app versions prior to version 2026.5.0. Within 7 days, obtain and validate version 2026.5.0 and establish a deployment plan through mobile device management. Within 30 days, complete deployment of version 2026.5.0 or later to all affected users.

Home Assistant iOS CVE-2026-66061

EUVD-2026-54675 HIGH

Missing Authorization (CWE-862)

2026-08-07 GitHub_M

Authentication Bypass Apple Core Home Assistant

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

AV:L because the malicious app must be co-installed on the same device; PR:N because no Home Assistant credentials are needed, only OS-level inter-app routing; S:C because impact extends from the iOS app to the broader HA automation engine and physical devices.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 07, 2026 - 22:17 EUVD

Source Code Evidence Fetched

Aug 07, 2026 - 21:36 vuln.today

Analysis Generated

Aug 07, 2026 - 21:36 vuln.today

CVE Published

Aug 07, 2026 - 20:43 cve.org

HIGH 7.1

DescriptionCVE.org

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.

AnalysisAI

The Home Assistant iOS Companion app silently executes tag-triggered automations when any co-installed untrusted app forwards a crafted tag event via iOS universal links, bypassing physical scan validation entirely. Affected versions are all iOS Companion app releases prior to 2026.5.0; the underlying Home Assistant core CPE (cpe:2.3:a:home-assistant:core:*:*:*:*:*:*:*:*) is also cited. Because automations can control physical devices such as smart locks and alarms, the I:H CVSS metric reflects real-world consequences beyond software state. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Home Assistant's iOS Companion app registers as a handler for tag-based URL schemes via iOS universal links, a mechanism designed to route web URLs or deep links to specific apps based on Associated Domains configuration. The vulnerability is rooted in CWE-862 (Missing Authorization): the app accepted any tag event delivered through this OS routing path without verifying the identity of the originating application or displaying a user confirmation prompt. NFC tags and QR codes normally require physical proximity, providing implicit assurance of user intent; by accepting programmatically routed tag events identically to physical scans, the app collapses that trust boundary. The fix, visible in commit 45e05e6666c74fdbea44cc4d6fb103043fff6fd9, introduces TagApprovalBottomSheet.swift (a UI confirmation layer), AllowedTag.swift and AllowedTagTable.swift (a persistent allowlist of authorized tag sources), and AllowedTagsView.swift (a management interface) - confirming the pre-fix absence of any source validation or user approval flow.

RemediationAI

Update the Home Assistant iOS Companion app to version 2026.5.0 or later, which introduces a tag source approval bottom sheet and a persistent allowlist mechanism that validates tag origins before executing any associated automation. The upstream fix is confirmed in commit 45e05e6666c74fdbea44cc4d6fb103043fff6fd9 and the vendor advisory is at https://github.com/home-assistant/core/security/advisories/GHSA-j23v-9672-677j. For users unable to update immediately, a targeted compensating control is to remove or disable any NFC or QR tag automations that control security-critical devices such as smart locks, alarm systems, or garage doors - this limits the impact of unauthorized tag forwarding to lower-consequence automations such as lighting scenes. Restricting device-level app installation to trusted sources (disabling enterprise profiles and avoiding sideloaded apps) reduces the threat surface, though this is an operational constraint with usability trade-offs. There is no network-layer block that mitigates this vulnerability since the attack vector is local inter-app communication.