CVE-2026-55844: Home Assistant iOS Companion app sensitive information leak via SSID allowlist bypass

CVE-2026-55844 · Severity: high · CVSS 7.5 · Published 2026-06-29

Home Assistant is a home automation platform that allows users to control smart devices. A security flaw in the iOS companion app causes it to ignore safety settings that restrict when it should connect to a home network. This can result in the app sending sensitive login tokens and sensor data over untrusted public Wi-Fi networks in plain text, potentially allowing an attacker to hijack the user's account or monitor their home activity.

Vendors: Home Assistant.

Quick answers

Is CVE-2026-55844 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55844 being exploited in the wild.
How severe is CVE-2026-55844?
High severity, with a CVSS score of 7.5, published 29 June 2026.
Which products and versions are affected?
Home Assistant Companion app (iOS) < 2025.5.0.
Is there a fix for CVE-2026-55844?
A patch was published on 2025-05-01: Approximate patch date based on version number 2025.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55844 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55844?
Check whether you run Home Assistant Companion app (iOS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Home Assistant iOS companion app (prior to version 2025.5.0) exists where the application ignores the SSID allowlist configured for internal network connections. While the app uses the SSID to determine when to use an internal URL, it incorrectly falls back to the internal URL even when the current SSID is not on the allowlist. Because internal URLs often use unencrypted HTTP, an attacker on the same network (such as a public Wi-Fi hotspot) can intercept the user's authentication token in cleartext. Furthermore, an attacker could host a rogue endpoint at the expected internal IP/hostname to capture both the token and accumulated sensor data. The fix in version 2025.5.0 introduces a 'Most secure' connection level that strictly enforces SSID checks.

Affected products

  • Home Assistant Home Assistant Companion app (iOS) < 2025.5.0

Timeline

  • 2026-06-25: advisory: GitHub Security Advisory published
  • 2026-06-29: disclosed: NVD publication date
  • 2025-05-01: patched: Approximate patch date based on version number 2025.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.