Executive brief
Home Assistant is an open-source home automation platform used to control smart devices and security systems. A security flaw in its Konnected alarm panel integration allows anyone on the same local network to view the status of home security sensors, sirens, and switches without a password. This could allow an unauthorized person to determine if an alarm is currently sounding or to map out the security configuration of a home before a physical intrusion.
Technical details
The Konnected integration in Home Assistant Core prior to 2026.6.0 contains a missing authentication vulnerability in its HTTP endpoint handler. While the 'KonnectedView' component (homeassistant/components/konnected/__init__.py) is globally marked with 'requires_auth = False', it only implements manual HMAC token verification for POST and PUT requests within the 'update_sensor()' method. The 'get()' method, which handles READ requests, lacks any authentication logic. An unauthenticated attacker on the local network can send GET requests to '/api/konnected/device/{device_id}' to enumerate valid device IDs, disclose the state of sirens and switches, and map the zone topology of the alarm panel. Additionally, each request triggers an outbound connection task to the hardware, which can be used for connection amplification attacks. This issue is resolved in version 2026.6.0.
Affected products
- Home Assistant Home Assistant Core < 2026.6.0
Timeline
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix released in version 2026.6.0