CVE-2026-66061

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.5.0

Description The iOS Companion app fails to validate the calling application or prompt the user when tag links (NFC or QR) are delivered via OS-level routing mechanisms, such as iOS universal links. Consequently, an untrusted application on the device can forward an arbitrary tag to Home Assistant, triggering the execution of associated automations as if a legitimate user had physically scanned an authorized tag. This allows for silent and unattended automation execution by untrusted local callers.

Recommendations Update to version 2026.5.0.