CVE-2026-59717— Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1566.001 · Spearphishing AttachmentGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing
Source: CVE Program / CVE List V5
Vulnerability Description
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| home-assistant | core | < 2026.6.1 | - |
II. Public POCs for CVE-2026-59717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59717
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-59717 (1)
Same Patch Batch · home-assistant · 2026-08-07 · 3 CVEs total
| CVE-2026-66060 | 7.1 HIGH | Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untruste |
| CVE-2026-66061 | 7.1 HIGH | Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling |
IV. Related Vulnerabilities
Same product: core
- CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans - CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent au - CVE-2026-71291
Bolt CMS Server-Side Template Injection via Unsandboxed allo - CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-s - CVE-2026-48795
Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
Same vendor: home-assistant
- CVE-2026-66061
Home Assistant: iOS Companion app forwards NFC/QR tag scans - CVE-2026-66060
Home Assistant: Unconfirmed NFC/QR tag scans allow silent au - CVE-2026-64825
Home Assistant Core < 2026.6.0 Path Traversal File Write via - CVE-2026-64824
Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE vi - CVE-2026-64823
Home Assistant Core < 2026.5.4 XSS via Shelly media_player.p
Same weakness: CWE-601
- CVE-2026-54215
TeamDavid: Open Redirect via the 'replyUrl' parameter - CVE-2026-54214
TeamDavid: Header Injection through the 'cType' URL paramete - CVE-2026-12071
TeamDavid: Header Injection leading to Open Redirect via URL - CVE-2026-66829
html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta - CVE-2026-66370
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form
V. Comments for CVE-2026-59717
No comments yet