CVE-2026-59717: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in home-assistant core
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
AI Analysis
Technical Summary
CVE-2026-59717 is an open redirect vulnerability (CWE-601) in the Home Assistant Android Companion app before version 2026.6.1. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without showing the destination hostname, preventing users from verifying the legitimacy of the invite. An attacker can exploit this by crafting an invite that redirects the user to a malicious /auth/authorize endpoint within the app's onboarding WebView, presenting a fake login page to capture credentials. This attack targets new users who are unlikely to notice the substitution. The issue is resolved in version 2026.6.1.
Potential Impact
An attacker can trick new users into submitting their credentials to a malicious login page embedded in the app's onboarding flow, potentially leading to credential theft. The vulnerability affects the confidentiality of user credentials but does not impact integrity or availability. There are no known exploits in the wild.
Mitigation Recommendations
This vulnerability is fixed in Home Assistant Android Companion app version 2026.6.1. Users and administrators should update to this version or later to remediate the issue. No other mitigation or workaround is documented.
CVE-2026-59717: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in home-assistant core
Description
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim's credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
CVSS v3.1
Score 4.3medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59717 is an open redirect vulnerability (CWE-601) in the Home Assistant Android Companion app before version 2026.6.1. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without showing the destination hostname, preventing users from verifying the legitimacy of the invite. An attacker can exploit this by crafting an invite that redirects the user to a malicious /auth/authorize endpoint within the app's onboarding WebView, presenting a fake login page to capture credentials. This attack targets new users who are unlikely to notice the substitution. The issue is resolved in version 2026.6.1.
Potential Impact
An attacker can trick new users into submitting their credentials to a malicious login page embedded in the app's onboarding flow, potentially leading to credential theft. The vulnerability affects the confidentiality of user credentials but does not impact integrity or availability. There are no known exploits in the wild.
Mitigation Recommendations
This vulnerability is fixed in Home Assistant Android Companion app version 2026.6.1. Users and administrators should update to this version or later to remediate the issue. No other mitigation or workaround is documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-06T15:34:16.916Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a763f94bf8831d5391b2931
Added to database: 08/07/2026, 20:27:00 UTC
Last enriched: 08/07/2026, 20:45:35 UTC
Last updated: 08/07/2026, 21:12:02 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.