CVE-2026-55844

{
  "id": "CVE-2026-55844",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T15:16:41.720",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0."
    },
    {
      "lang": "es",
      "value": "Home Assistant es un software de automatización del hogar de código abierto que prioriza el control local y la privacidad. Antes de la versión 2025.5.0, la aplicación complementaria de iOS ignora la lista blanca de SSID para redes internas. La aplicación utiliza el SSID para detectar cuándo usar la URL interna, pero cada vez que la aplicación no puede encontrar ninguna otra URL para usar, también recurre a la URL interna, lo que puede exponer el token del usuario cuando está conectado a una red no segura. Esta vulnerabilidad está corregida en la versión 2025.5.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "home-assistant",
          "product": "core",
          "versions": [
            {
              "version": "< 2025.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-30T19:01:55.626908Z",
          "id": "CVE-2026-55844",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/home-assistant/core/security/advisories/GHSA-cm5v-547m-qh5h",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/home-assistant/core/security/advisories/GHSA-cm5v-547m-qh5h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}