Executive brief
Home Assistant is a home automation platform that allows users to control smart devices. A security flaw in the iOS companion app causes it to ignore safety settings that restrict when it should connect to a home network. This can result in the app sending sensitive login tokens and sensor data over untrusted public Wi-Fi networks in plain text, potentially allowing an attacker to hijack the user's account or monitor their home activity.
Technical details
A vulnerability in the Home Assistant iOS companion app (prior to version 2025.5.0) exists where the application ignores the SSID allowlist configured for internal network connections. While the app uses the SSID to determine when to use an internal URL, it incorrectly falls back to the internal URL even when the current SSID is not on the allowlist. Because internal URLs often use unencrypted HTTP, an attacker on the same network (such as a public Wi-Fi hotspot) can intercept the user's authentication token in cleartext. Furthermore, an attacker could host a rogue endpoint at the expected internal IP/hostname to capture both the token and accumulated sensor data. The fix in version 2025.5.0 introduces a 'Most secure' connection level that strictly enforces SSID checks.
Affected products
- Home Assistant Home Assistant Companion app (iOS) < 2025.5.0
Timeline
- 2026-06-25: advisory: GitHub Security Advisory published
- 2026-06-29: disclosed: NVD publication date
- 2025-05-01: patched: Approximate patch date based on version number 2025.5.0