CVE-2026-59717 home-assistant CVE debrief

Who should care

Defenders responsible for Home Assistant deployments, particularly those using the Android Companion app, should assess exposure and prioritize upgrading to version 2026.6.1 or later.

Why it matters

The CVE-2026-59717 vulnerability in the Home Assistant Android Companion app allows for credential capture through look-alike login pages. Defenders should prioritize verifying and upgrading to version 2026.6.1 or later, assessing exposure, and monitoring for suspicious activity. The vulnerability is particularly concerning for targets unlikely to notice substitutions, such as brand-new users.

• Credential capture through look-alike login pages
• Potential for phishing attacks through malicious invites
• Need for verification of Home Assistant Android Companion app versions
• Importance of monitoring onboarding activity for suspicious behavior

Technical summary

The Home Assistant Android Companion app, prior to version 2026.6.1, passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname. This allows an attacker to craft a malicious invite that, when tapped, opens their /auth/authorize endpoint in the onboarding WebView, presenting a look-alike login page to capture the victim's credentials.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2026.6.1 or later, assessing exposure in their Home Assistant deployments, and monitoring for suspicious onboarding activity.

Recommended defensive actions

• Verify and upgrade to version 2026.6.1 or later
• Assess exposure in Home Assistant deployments
• Monitor for suspicious onboarding activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and source references provide details on the vulnerability, its impact, and the fix. However, there is limited information on potential exploitation or victim impact. Defenders should verify and upgrade to version 2026.6.1 or later, assess exposure, and monitor for suspicious activity. The Android Companion app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft a malicious invite. The vulnerability is fixed,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.