CVE-2026-55844: Home Assistant iOS App SSID Allowlist Bypass Exposes Authentication Token

Technical summary

CVE-2026-55844 affects the Home Assistant iOS companion app prior to version 2025.5.0. The vulnerability stems from improper SSID allowlist enforcement. While the app attempts to use SSID matching to determine when to switch to internal URLs, a fallback mechanism exists that uses the internal URL whenever no other URL is available—bypassing SSID validation. An attacker on the same network segment could potentially intercept the authentication token transmitted in this fallback scenario. The issue is classified as CWE-319 (Cleartext Transmission of Sensitive Information).

Business impact

For Home Assistant users, this vulnerability could enable token theft on public or untrusted WiFi networks, leading to unauthorized access to home automation systems. An attacker gaining a valid authentication token could control smart home devices, modify automations, or access sensitive home data. While Home Assistant itself is self-hosted, widespread iOS app compromise could expose thousands of installations simultaneously if users connect to hostile networks before patching.

Affected systems

The Home Assistant iOS companion app in all versions prior to 2025.5.0 is affected. Home Assistant server itself is not directly vulnerable; only the mobile client contains the defective SSID enforcement logic. Users running Home Assistant on any backend platform (Docker, bare metal, Hass.io) are at risk if they use the vulnerable iOS app.

Exploitability

Exploitation requires an attacker to be on the same network (or able to spoof network presence) where a vulnerable iOS app attempts to connect. No authentication is required from the attacker's side, and exploitation does not depend on user interaction—it occurs during the app's automatic fallback behavior when preferred URLs are unavailable. The CVSS 7.5 HIGH score reflects the network adjacency requirement but the ease of triggering token exposure once that condition is met.

Remediation

Update the Home Assistant iOS companion app to version 2025.5.0 or later immediately. This version restores proper SSID allowlist enforcement and eliminates the unsafe fallback behavior. Users should verify the app updates via the Apple App Store and confirm their app version in settings. No server-side changes are required, but all iOS users should be treated as requiring this patch.

Patch guidance

Navigate to the Apple App Store, search for 'Home Assistant,' and update to the latest version (verify it is 2025.5.0 or later). If automatic updates are enabled, confirm the update has completed and the app version reflects the patched release. Users with critical Home Assistant instances should prioritize this update before allowing the old app version to connect to their networks.

Detection guidance

Monitor for unusual token usage or new device connections in your Home Assistant instance logs when iOS app users are on untrusted networks. Check the app version in Home Assistant's Companion App settings to identify devices still running pre-2025.5.0. Network administrators can also detect token exposure via traffic inspection if HTTPS interception is available, though this may not catch all variants depending on app behavior.

Why prioritize this

This vulnerability has a HIGH CVSS score (7.5) and affects a widely-used automation platform during an era of increased smart home adoption. While exploitation requires network proximity, the complete token exposure and ease of triggering make this a priority for any organization or household relying on Home Assistant for critical functions (security systems, access control). The fix is straightforward and non-disruptive.

Risk score, explained

The 7.5 CVSS score reflects: (1) Network-only attack surface (AV:N) with low complexity (AC:L) and no privilege or user interaction required, (2) High confidentiality impact (C:H) through token theft, but (3) no integrity or availability impact. The score appropriately captures that this is a passive information disclosure in an authentication context, making it serious but not system-breaking.

Frequently asked questions