CVE-2026-59717: Home Assistant Open Redirect Vulnerability

CVE-2026-59717 Overview

CVE-2026-59717 is an open redirect vulnerability [CWE-601] in the Home Assistant Android Companion app. The flaw exists in the homeassistant://invite deep link handler, which passes the URL fragment directly into the onboarding flow without displaying the destination hostname. An attacker can craft a malicious invitation link that opens an attacker-controlled /auth/authorize endpoint inside a URL-less WebView, presenting a look-alike login page that captures the victim's credentials. Because invitations target brand-new users, victims have no baseline to detect the substitution. The issue is fixed in version 2026.6.1.

Critical Impact
A single tap on a malicious invite link can silently direct the Home Assistant Android app to an attacker-controlled login page, enabling credential capture during onboarding.

Affected Products

Home Assistant Android Companion app prior to 2026.6.1
Home Assistant deployments relying on the mobile invitation onboarding flow
Users receiving homeassistant://invite deep links

Discovery Timeline

2026-08-07 - CVE-2026-59717 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-59717

Vulnerability Analysis

The Home Assistant Android app registers a deep link scheme for homeassistant://invite URLs. When a user taps such a link, the app parses the URL fragment containing the target server address and passes it into the onboarding flow. The onboarding WebView then loads the /auth/authorize endpoint on the specified server. No screen in the invitation flow displays the parsed server URL before onboarding commits, and the WebView itself hides the address bar. Attackers can substitute their own server URL, presenting a login page that visually matches Home Assistant.

Root Cause

The root cause is missing destination validation and missing UI confirmation before initiating an authenticated WebView session. The startLaunchOnboarding function accepted an arbitrary urlToOnboard string derived from external deep link input. The onboarding path treated invitation links identically to first-run welcome flows, without a dedicated review step that would let the user inspect the hostname.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted homeassistant://invite link via email, SMS, QR code, or a website. When the victim taps the link, Android launches the Home Assistant Companion app, which opens the attacker's authorization endpoint in the onboarding WebView. The victim sees a login prompt that appears legitimate and submits credentials to the attacker-controlled host.

text

// Patch: Add dedicated screen for invitation flow instead of WelcomeScreen (#6955)
// File: app/src/main/kotlin/io/homeassistant/companion/android/launch/LaunchActivity.kt

            val skipWelcome: Boolean,
        ) : DeepLink

+       /**
+        * Opens the onboarding flow from an invitation link.
+        *
+        * @property serverUrl The Home Assistant server URL the invitation wants to connect to.
+        */
+       data class OpenInvitation(val serverUrl: String) : DeepLink
+
        /**
         * Navigates to a specific path within the webview.
         * @property path The path to navigate to within the Home Assistant interface.

Source: GitHub Commit 26154d9

The patch introduces a new OpenInvitation deep link type and a dedicated startLaunchInvitation entry point, replacing the previous generic onboarding call that accepted an unvalidated URL.

Detection Methods for CVE-2026-59717

Indicators of Compromise

Unexpected homeassistant://invite deep links delivered through email, SMS, or messaging platforms
Outbound mobile traffic to unknown hosts serving /auth/authorize paths that mimic Home Assistant login UI
User reports of unfamiliar Home Assistant login prompts appearing after tapping an invitation link
Authentication attempts to legitimate Home Assistant instances originating from unfamiliar IP addresses shortly after phishing campaigns

Detection Strategies

Inspect mobile device management (MDM) telemetry for Home Assistant Companion app versions below 2026.6.1
Monitor DNS and proxy logs for lookups to typosquatted domains resembling legitimate Home Assistant server URLs
Correlate email or messaging gateway logs for URLs beginning with homeassistant://invite from untrusted senders

Monitoring Recommendations

Alert on Home Assistant authentication events from geolocations or user agents inconsistent with the user's baseline
Track failed and successful logins after mass distribution of invitation-style phishing lures
Review outbound traffic from mobile devices to newly registered domains hosting /auth/authorize endpoints

How to Mitigate CVE-2026-59717

Immediate Actions Required

Upgrade the Home Assistant Android Companion app to version 2026.6.1 or later through Google Play or F-Droid
Instruct users not to tap homeassistant://invite links received from untrusted sources
Rotate credentials for any Home Assistant accounts whose users may have interacted with suspicious invitation links

Patch Information

The vendor addressed CVE-2026-59717 in Home Assistant Android Companion 2026.6.1. The fix, delivered in pull request #6955, introduces a dedicated OpenInvitation deep link type and a separate invitation screen that surfaces the destination server URL before onboarding proceeds. See the GitHub Security Advisory GHSA-68f4-97mf-f68w for full advisory details.

Workarounds

Disable or restrict handling of homeassistant:// deep links at the MDM level until the patched app is deployed
Require users to onboard the Home Assistant app manually by entering the server URL rather than via invitation links
Enable multi-factor authentication on Home Assistant accounts to reduce impact of captured passwords

bash

# Verify installed Home Assistant Companion app version on a managed Android device
adb shell dumpsys package io.homeassistant.companion.android | grep versionName

# Expected patched output:
#   versionName=2026.6.1