Home Assistant core versions before 2026.5.0 contain a missing authorization vulnerability (CWE-862) in the iOS Companion app. The app treats tag links delivered via OS-level routing mechanisms such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. Consequently, any untrusted app on the device can forward arbitrary tag data to Home Assistant, causing it to execute associated automations silently and unattended. This vulnerability allows unauthorized local callers to trigger automations without user consent. The issue is resolved in version 2026.5.0.

An attacker with an untrusted app on the same iOS device can silently trigger Home Assistant automations without user interaction or authorization. This can lead to unauthorized automation execution, potentially causing security or privacy risks depending on the automation's function. There is no impact on confidentiality or availability reported, but integrity is impacted due to unauthorized automation execution.

Upgrade Home Assistant core to version 2026.5.0 or later, where this vulnerability has been fixed. Prior to upgrading, be cautious about installing untrusted iOS apps that might exploit this issue. No other official remediation or temporary fixes are documented.