Description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-07T21:17:29.520Z",
  "pubdate": "2026-08-07T21:17:29.520Z",
  "executiveSummary": "An improper input validation vulnerability exists within the Home Assistant Companion app prior to version 2026.5.3 (fixed in version 2026.8.1). The vulnerability involves the application's handling of OS-level routing mechanisms for tag links, such as NFC or QR codes. Specifically, the Companion app treats these externally delivered tag links as physically scanned inputs without performing validation on the calling application or prompting the local user for confirmation. This security flaw enables any untrusted application installed on the host device to forward arbitrary tag identifiers to Home Assistant.\nThe primary impact of this vulnerability is the unauthorized and silent execution of associated automations, mimicking a legitimate user physically scanning an authorized tag. An attacker leveraging this flaw possesses local execution capabilities via an untrusted application, bypassing standard physical proximity and user interaction requirements. The risk implications include the potential manipulation of smart home devices, unauthorized physical access triggering, or execution of sensitive home automation routines without user awareness or consent. Exploitation requires local code execution capabilities on the affected mobile device hosting the Home Assistant Companion app.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper processing and trust assumption of OS-level routing mechanisms within the Home Assistant Companion app. When an operating system routes a URI or intent containing a tag link to the Companion app, the vulnerable component fails to implement adequate caller verification. It does not validate the package name, cryptographic signature, or provenance of the calling application, nor does it enforce a user consent prompt or authorization check before processing the payload.\nThe vulnerable component is the URI and intent handling subsystem of the Home Assistant Companion app across versions prior to 2026.5.3. Authentication and privilege requirements are minimal for exploitation; any local application running on the mobile device possesses the necessary privileges to broadcast intents or invoke URI schemes handled by the Companion app, regardless of isolation boundaries or permission models.\nThe step-by-step attack flow proceeds as follows: First, an attacker deploys or compromises an untrusted application on the target mobile device where the Home Assistant Companion app is installed. Second, the malicious or compromised application crafts a specially formatted tag link payload corresponding to a target NFC or QR tag configured within the user's Home Assistant instance. Third, the untrusted application utilizes OS-level routing facilities, such as intent broadcasting or URI launching, to transmit the crafted tag link directly to the Home Assistant Companion app. Fourth, the Companion app receives the routing payload and inherently trusts the input, bypassing physical interaction requirements and caller authentication. Finally, the Companion app forwards the tag data to the Home Assistant server, triggering the execution of the associated automation rule silently and without user interaction, leading to unauthorized state changes or actions within the smart home environment."
}