CVE-2026-59717

Name of the Vulnerable Software and Affected Versions Home Assistant Android Companion app versions prior to 2026.6.1

Description The Android Companion app contains an open redirect issue where the application processes the URL fragment from a homeassistant://invite deep link during the onboarding flow without displaying the destination hostname. This allows an attacker to craft a malicious invitation that directs the user to a fraudulent /auth/authorize endpoint via a WebView. Because the server URL is not shown before the process is committed, users may be deceived into entering their credentials into a look-alike login page.

Recommendations Update to version 2026.6.1.