CVE-2026-55844 HIGH

CVE-2026-55844: Home Assistant: iOS Companion App ignores internal SSID allowlist for connections – possible leak of access token and sensor data

Vendor Home-Assistant
Product core
Weakness CWE-319 · Cleartext transmission
Published June 29, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.

Key dates

02Disclosure timeline

June 29, 2026 CVE published
June 30, 2026 Record updated