Description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-07T21:17:29.197Z",
  "pubdate": "2026-08-07T21:17:29.197Z",
  "executiveSummary": "An open redirect vulnerability exists in the Home Assistant Android Companion app prior to version 2026.6.1. The flaw resides within the handling of the homeassistant://invite deep link, which improperly processes URL fragments during the onboarding flow without presenting the destination hostname to the user. This creates a critical trust boundary violation where a victim cannot distinguish between a legitimate server invitation and a maliciously crafted one.\nThe primary impact of this vulnerability is credential theft. An attacker capable of delivering a crafted deep link can induce a victim to interact with a seemingly legitimate onboarding interface. Upon tapping the Connect to my Home Assistant server button, the application loads an attacker-controlled /auth/authorize endpoint within an un-addressed onboarding WebView. This renders a convincing look-alike login interface capable of harvesting sensitive user credentials.\nThe risk implication is elevated due to the target demographic: brand-new users undergoing the onboarding process are inherently trusting and lack established baselines for their server URLs, making them exceptionally vulnerable to social engineering via invitations. Successful exploitation requires the attacker to craft a malicious deep link and entice the victim into clicking it, bypassing authentication and privilege requirements since it occurs prior to initial session establishment.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure parameter handling within the onboarding flow of the Android Companion app. When processing a homeassistant://invite deep link, the application extracts the URL fragment and passes it directly into the onboarding mechanism. The vulnerable component fails to implement validation or UI transparency measures, omitting any screen that displays the parsed destination hostname before the application commits to the connection.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious deep link utilizing the homeassistant://invite protocol scheme with a modified URL fragment pointing to an external or attacker-controlled infrastructure. Second, the victim receives and interacts with the crafted invite, which triggers the Android Companion app via intent resolution. Third, the application launches the onboarding WebView, loading the attacker-specified /auth/authorize endpoint without surfacing the underlying URL or destination hostname to the user interface.\nFourth, presented with the standard onboarding UI containing the legitimate-looking Connect to my Home Assistant server button, the victim performs a single tap. Finally, the WebView renders a high-fidelity phishing or look-alike login page hosted by the attacker, facilitating the interception and capture of the victim's credentials.\nThe vulnerability affects the Android Companion app for Home Assistant prior to version 2026.6.1. Exploitation requires no prior authentication or system privileges, as it occurs externally via intent handling during the initial setup phase. Network exposure is contingent upon the victim accessing the malicious deep link over the network, leading directly to post-exploitation risks centered around credential compromise and unauthorized access to the Home Assistant instance."
}