CVE-2026-55844: Home Assistant Information Disclosure Flaw

CVE-2026-55844 Overview

CVE-2026-55844 affects the Home Assistant iOS companion app in versions prior to 2025.5.0. The app uses the Service Set Identifier (SSID) allowlist to determine when to use an internal URL for connecting to a Home Assistant instance. When the app cannot identify any other URL to use, it falls back to the internal URL regardless of the current network. This fallback behavior can expose the user's authentication token when the device is connected to an untrusted network. The issue is categorized under Cleartext Transmission of Sensitive Information [CWE-319]. Home Assistant patched the flaw in release 2025.5.0.

Critical Impact
Attackers on the same untrusted network can capture Home Assistant authentication tokens transmitted to internal URLs, enabling unauthorized access to home automation systems.

Affected Products

Home Assistant iOS companion app versions prior to 2025.5.0
Home Assistant deployments relying on SSID-based internal URL routing
Users accessing Home Assistant instances from mobile devices on untrusted Wi-Fi

Discovery Timeline

2026-06-29 - CVE-2026-55844 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-55844

Vulnerability Analysis

The Home Assistant iOS companion app supports separate internal and external URLs for reaching a user's Home Assistant instance. The app checks the current Wi-Fi SSID against an allowlist to determine whether to use the internal URL. This design assumes that internal URLs only appear when the device is connected to a trusted network.

The vulnerability stems from an unsafe fallback path in the URL selection logic. When the app cannot resolve any other URL, it defaults to the internal URL even when the current SSID is not in the allowlist. The internal URL typically points to a plaintext HTTP endpoint on a local network, and the app transmits the bearer token used to authenticate to the Home Assistant API.

Attackers on the same network as the victim can intercept these requests. The authentication token grants full access to the Home Assistant instance, including device control and stored automation data.

Root Cause

The root cause is improper enforcement of the SSID allowlist in the URL selection logic. The allowlist acts as a gate for using the internal URL, but the fallback path skips this check entirely. This design flaw maps to [CWE-319], Cleartext Transmission of Sensitive Information, because the token is sent over an internal URL that is not guaranteed to be on a trusted network.

Attack Vector

An attacker positions themselves on an untrusted network shared with the victim's iOS device. When the Home Assistant app cannot find a valid external URL, it falls back to the internal URL and issues an authenticated request. The attacker captures the bearer token from the network traffic using standard interception tools. The token can then be replayed against the Home Assistant instance to control connected devices and access user data.

The vulnerability is exploitable over the network without authentication or user interaction beyond normal app usage.

Detection Methods for CVE-2026-55844

Indicators of Compromise

Home Assistant API access from unfamiliar source IP addresses or geographies outside expected user patterns
Authentication events using long-lived access tokens from unexpected client identifiers
Unusual device control commands issued during time windows when the user was traveling or on public Wi-Fi

Detection Strategies

Review Home Assistant home-assistant.log for authenticated API requests originating from non-local IP ranges
Inspect network captures on managed corporate or guest Wi-Fi for cleartext requests carrying Authorization: Bearer headers to Home Assistant hostnames
Correlate iOS companion app version telemetry with known-vulnerable releases prior to 2025.5.0

Monitoring Recommendations

Enable Home Assistant login and API access logging, and forward logs to a central analytics platform for review
Alert on new token creation events and on token use from previously unseen networks
Monitor for repeated authentication using the same long-lived token across geographically inconsistent locations

How to Mitigate CVE-2026-55844

Immediate Actions Required

Update the Home Assistant iOS companion app to version 2025.5.0 or later on all user devices
Rotate long-lived access tokens issued to the iOS companion app if devices were used on untrusted networks
Enforce HTTPS with a valid certificate for the internal Home Assistant URL to prevent cleartext token exposure

Patch Information

Home Assistant fixed the SSID allowlist bypass in the iOS companion app release 2025.5.0. Details are available in the GitHub Security Advisory GHSA-cm5v-547m-qh5h. Users should upgrade through the Apple App Store and confirm the installed version.

Workarounds

Disable the iOS companion app until it can be updated to 2025.5.0 or later
Configure the Home Assistant instance to require HTTPS on the internal URL and reject cleartext connections
Avoid using the Home Assistant iOS companion app on public or untrusted Wi-Fi networks until patched

bash

# Example: enforce HTTPS on the internal URL in configuration.yaml
http:
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  server_port: 8123