CVE-2026-66061: Home Assistant Auth Bypass Vulnerability

CVE-2026-66061 Overview

CVE-2026-66061 affects the Home Assistant iOS Companion app in versions prior to 2026.5.0. The app treats NFC and QR tag links delivered through iOS universal links as physically scanned tags. It does not validate the calling app or prompt the user for confirmation. Any untrusted app on the device can forward an arbitrary tag to Home Assistant. The app then executes the associated automation as if a legitimate user scanned an authorized tag. The flaw maps to CWE-862: Missing Authorization and enables silent, unattended automation execution by local callers.

Critical Impact
Untrusted local apps can trigger authorized Home Assistant automations without user interaction, integrity impact is High.

Affected Products

Home Assistant iOS Companion app versions prior to 2026.5.0
Deployments relying on NFC or QR tag automations on iOS
iOS devices with untrusted apps capable of invoking universal links

Discovery Timeline

2026-08-07 - CVE-2026-66061 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-66061

Vulnerability Analysis

The Home Assistant iOS Companion app exposes tag-scanning functionality through iOS universal links. Universal links allow other apps and web contexts to open URLs directly in a registered handler app. The Companion app accepted these routed URLs as trusted tag scans. It did not distinguish between a physical NFC read, a camera-based QR scan, and an OS-routed URL from another app.

Because tag identifiers in Home Assistant can be bound to automations, forwarding a known tag URL is functionally equivalent to executing the automation. Attackers with a foothold in any local app, including malicious apps installed by the user, can invoke the handler and trigger sensitive actions. Examples include unlocking smart locks, disarming alarms, and opening garage doors.

Root Cause

The root cause is missing authorization in the IncomingURLHandler code path. The handler called Current.tags.handle(userActivity:) and immediately displayed a read-confirmation animation before executing the tag. It did not verify the origin of the NSUserActivity or require an explicit user approval step for OS-routed invocations.

Attack Vector

Exploitation is local. An untrusted app on the same iOS device crafts a universal link containing a valid Home Assistant tag identifier. iOS routes the link to the Companion app, which processes the tag as a legitimate scan. No user interaction is required, and the scope change reflects impact on downstream connected devices controlled by Home Assistant automations.

text

// Vulnerable path in Sources/App/Frontend/IncomingURLHandler.swift (pre-patch)
switch Current.tags.handle(userActivity: userActivity) {
case let .handled(type):
    // Displays a read confirmation animation, then executes the tag automation
    // without validating the calling context or requiring user approval.
    Current.sceneManager.showFullScreenConfirm(
        icon: icon,
        text: text,
        onto: .value(windowController.window)
    )

Source: GitHub iOS Commit 45e05e6

Detection Methods for CVE-2026-66061

Indicators of Compromise

Home Assistant automation executions attributed to tag scans without corresponding user presence or device unlock events
Repeated tag-triggered automations originating within short intervals from the same mobile client
Unexpected state changes on lock, alarm, or access-control entities tied to tag automations

Detection Strategies

Review Home Assistant logbook and history for tag-scan events correlated with sensitive automation runs
Correlate Companion app tag events with mobile device state such as screen-locked or user-inactive periods
Alert on tag identifiers being invoked from clients that have never previously performed a physical scan

Monitoring Recommendations

Enable verbose logging on the tag integration and forward Home Assistant logs to a centralized log store
Monitor iOS Mobile Device Management (MDM) telemetry for newly installed apps that could invoke universal links
Track Companion app versions across the fleet and flag installs below 2026.5.0

How to Mitigate CVE-2026-66061

Immediate Actions Required

Upgrade the Home Assistant iOS Companion app to version 2026.5.0 or later on all managed devices
Audit tag-bound automations and remove or restrict any that control physical security devices
Rotate tag identifiers for automations retained after the upgrade to invalidate any leaked tag values

Patch Information

The fix is included in Home Assistant iOS Companion 2026.5.0. The patch introduces a requiresApproval result path and a TagApprovalBottomSheet that prompts the user with allow-once or allow-always options before executing an OS-routed tag. See the GitHub Security Advisory GHSA-j23v-9672-677j and the remediation commit.

swift

// Patched path in Sources/App/Frontend/IncomingURLHandler.swift
switch Current.tags.handle(userActivity: userActivity) {
case let .handled(type):
    showTagReadConfirmation(type: type)
    return true
case let .requiresApproval(tag, type):
    showTagApproval(tag: tag, type: type)
    return true