CVE-2026-66060: Home Assistant Auth Bypass Vulnerability

CVE-2026-66060 Overview

CVE-2026-66060 is a missing authorization vulnerability [CWE-862] in the Home Assistant Companion app for Android. The app treats tag links (NFC or QR) delivered through Android's OS-level intent routing as if they were physically scanned by the user. The app fails to validate the calling application or prompt the user before executing the associated automation. Any untrusted app installed on the same device can forward an arbitrary tag URL to Home Assistant. This causes the target automation to run silently, without user interaction. The issue affects Companion app versions prior to 2026.5.3 and is fixed in version 2026.8.1.

Critical Impact
A locally installed untrusted app can trigger arbitrary Home Assistant automations, including physical actions such as unlocking doors, disarming alarms, or controlling connected devices.

Affected Products

Home Assistant Companion app for Android prior to 2026.5.3
Home Assistant Core integrations relying on tag-based automations
Android devices with the Home Assistant Companion app installed alongside untrusted applications

Discovery Timeline

2026-08-07 - CVE-2026-66060 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-66060

Vulnerability Analysis

The Home Assistant Companion app exposes TagReaderActivity as an exported Android activity. This activity handles android.intent.action.VIEW intents for URLs matching the Home Assistant tag path prefix. The activity implicitly trusts any incoming intent, treating a routed link identically to a tag physically scanned by the user via NFC or QR. Home Assistant tags map to automations configured by the user, which may perform sensitive real-world actions such as controlling smart locks, garage doors, alarms, or lighting.

Because the activity is exported and accepts external intents without verifying the caller, any application on the device with no special permissions can send an intent containing a known tag identifier. The Companion app forwards the tag event to the Home Assistant backend, which executes the linked automation as if the authenticated user had performed the scan.

Root Cause

The root cause is a missing authorization check in the intent handling path of TagReaderActivity. The activity does not verify the calling package, does not require a confirmation prompt, and does not distinguish between a hardware-driven scan (NFC/QR camera) and an OS-routed deep link.

Attack Vector

Exploitation requires local access on the same Android device, achieved by installing any untrusted application. The malicious app crafts an implicit intent targeting a Home Assistant tag URL. Android routes the intent to the Companion app, which executes the associated automation without user interaction. No permissions or elevated privileges are required from the attacker's app.

xml

<!-- Patched AndroidManifest.xml: TagReaderActivity hardened with single-task launch,
     translucent overlay, and BottomSheet confirmation UI -->
<activity
    android:name=".nfc.TagReaderActivity"
    android:label="@string/tag_reader_title"
    android:launchMode="singleTask"
    android:taskAffinity="io.homeassistant.companion.android.tag.reader"
    android:autoRemoveFromRecents="true"
    android:exported="true"
    android:theme="@style/Theme.HomeAssistant.TranslucentOverlay">
    <tools:validation testUrl="https://www.home-assistant.io/tag/123e4567-e89b-12d3-a456-426614174000" />
    <intent-filter>
        <!-- ... -->
    </intent-filter>
</activity>

Source: Home Assistant Android commit 968b49c

Detection Methods for CVE-2026-66060

Indicators of Compromise

Home Assistant automation execution logs showing tag scans without corresponding user presence or physical device activity
Companion app tag events originating shortly after installation or launch of a newly installed Android application
Automation triggers occurring while the device screen is off or the user is inactive

Detection Strategies

Review Home Assistant logbook entries for tag_scanned events and correlate against known device locations and user activity
Enumerate installed Android packages on devices running the Companion app and flag applications from unknown sources
Compare Companion app versions across mobile inventory to identify devices still running versions prior to 2026.8.1

Monitoring Recommendations

Enable verbose logging on Home Assistant automations tied to physical access, locks, or alarms and forward logs to a central SIEM
Alert on tag-triggered automations that fall outside expected time windows or user routines
Monitor mobile device management (MDM) telemetry for sideloaded APKs on devices with Companion app installed

How to Mitigate CVE-2026-66060

Immediate Actions Required

Update the Home Assistant Companion app for Android to version 2026.8.1 or later on all user devices
Audit existing tag-based automations and remove or disable any that perform high-impact actions such as unlocking doors or disarming alarms
Restrict installation of untrusted applications on Android devices used to run the Companion app, using MDM controls where available

Patch Information

The fix is released in Home Assistant Companion app version 2026.8.1. The patch migrates TagReaderActivity to a translucent overlay with a BottomSheet confirmation UI, requiring explicit user confirmation before an automation is executed. See the GitHub Security Advisory GHSA-2xqv-hwrf-983f and the remediation commit for details.

Workarounds

Temporarily disable or delete sensitive tag automations in Home Assistant until the Companion app is upgraded
Require additional authentication factors, such as a PIN entry or presence check, inside the automation logic itself
Uninstall the Companion app on devices where updating to 2026.8.1 is not immediately possible and rely on the web UI

bash

# Verify installed Companion app version via ADB
adb shell dumpsys package io.homeassistant.companion.android | grep versionName

# Expected output for patched devices:
# versionName=2026.8.1