CVE-2026-66061

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66061
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66061.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66061
Aliases
  • GHSA-j23v-9672-677j
Published
2026-08-07T20:43:41.785Z
Modified
2026-08-09T03:46:07.283896632Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution
Details

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66061.json"
}
References

Affected packages

Git / github.com/home-assistant/core

Affected ranges

Type
GIT
Repo
https://github.com/home-assistant/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b10582b0a906658ca1f2424d9fb3b7149f066fa4
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.5.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/home-assistant/ios
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
45e05e6666c74fdbea44cc4d6fb103043fff6fd9
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.103.0
0.103.0b0
0.103.0b1
0.103.1
0.103.2
0.103.3
0.103.4
0.103.5
0.103.6
0.104.0
0.104.1
0.104.2
0.104.3
0.105.0
0.105.1
0.105.2
0.105.3
0.105.4
0.105.5
0.106.0
0.106.1
0.106.2
0.106.3
0.106.4
0.106.5
0.106.6
0.107.0
0.107.1
0.107.2
0.107.3
0.107.4
0.107.5
0.107.6
0.107.7
0.108.0
0.108.1
0.108.2
0.108.3
0.108.4
0.108.5
0.108.6
0.108.7
0.108.8
0.108.9
0.109.0
0.109.1
0.109.2
0.109.3
0.109.4
0.109.5
0.109.6
0.110.0
0.110.1
0.110.2
0.110.3
0.110.4
0.110.5
0.110.6
0.110.7
0.111.0
0.111.1
0.111.2
0.111.3
0.111.4
0.112.0
0.112.1
0.112.2
0.112.3
0.112.4
0.112.5
0.113.0
0.113.1
0.113.2
0.113.3
0.114.0
0.114.1
0.114.2
0.114.3
0.114.4
0.115.0
0.115.1
0.115.2
0.115.3
0.115.4
0.115.5
0.115.6
0.116.0
0.116.1
0.116.2
0.116.3
0.116.4
0.117.0
0.117.1
0.117.2
0.117.3
0.117.4
0.117.5
0.117.6
0.118.0
0.118.1
0.118.2
0.118.3
0.118.4
0.118.5
0.28
0.7.6
0.81.1
2019.*
2019.1
2020.*
2020.12.0
2020.12.1
2020.12.2
2021.*
2021.1.0
2021.1.1
2021.1.2
2021.1.3
2021.1.4
2021.1.5
2021.10.0
2021.10.1
2021.10.2
2021.10.3
2021.10.4
2021.10.5
2021.10.6
2021.10.7
2021.11.0
2021.11.1
2021.11.2
2021.11.3
2021.11.4
2021.11.5
2021.12.0
2021.12.1
2021.12.10
2021.12.2
2021.12.3
2021.12.4
2021.12.5
2021.12.6
2021.12.7
2021.12.8
2021.12.9
2021.2.0
2021.2.1
2021.2.2
2021.2.3
2021.3.0
2021.3.1
2021.3.2
2021.3.3
2021.3.4
2021.4.0
2021.4.1
2021.4.2
2021.4.3
2021.4.4
2021.4.5
2021.4.6
2021.5.0
2021.5.1
2021.5.2
2021.5.3
2021.5.4
2021.5.5
2021.6.0
2021.6.1
2021.6.2
2021.6.3
2021.6.4
2021.6.5
2021.6.6
2021.7.0
2021.7.1
2021.7.2
2021.7.3
2021.7.4
2021.8.0
2021.8.1
2021.8.2
2021.8.3
2021.8.4
2021.8.5
2021.8.6
2021.8.7
2021.8.8
2021.9.0
2021.9.1
2021.9.2
2021.9.3
2021.9.4
2021.9.5
2021.9.6
2021.9.7
2022.*
2022.10.0
2022.10.1
2022.10.2
2022.10.3
2022.10.4
2022.10.5
2022.11.0
2022.11.1
2022.11.2
2022.11.3
2022.11.4
2022.11.5
2022.12.0
2022.12.1
2022.12.2
2022.12.3
2022.12.4
2022.12.5
2022.12.6
2022.12.7
2022.12.8
2022.12.9
2022.2.0
2022.2.1
2022.2.2
2022.2.3
2022.2.4
2022.2.5
2022.2.6
2022.2.7
2022.2.8
2022.2.9
2022.3.0
2022.3.1
2022.3.2
2022.3.3
2022.3.4
2022.3.5
2022.3.6
2022.3.7
2022.3.8
2022.4.0
2022.4.1
2022.4.2
2022.4.3
2022.4.4
2022.4.5
2022.4.6
2022.4.7
2022.5.0
2022.5.1
2022.5.2
2022.5.3
2022.5.4
2022.5.5
2022.6.0
2022.6.1
2022.6.2
2022.6.3
2022.6.4
2022.6.5
2022.6.6
2022.6.7
2022.7.0
2022.7.1
2022.7.2
2022.7.3
2022.7.4
2022.7.5
2022.7.6
2022.7.7
2022.8.0
2022.8.1
2022.8.2
2022.8.3
2022.8.4
2022.8.5
2022.8.6
2022.8.7
2022.9.0
2022.9.1
2022.9.2
2022.9.3
2022.9.4
2022.9.5
2022.9.6
2022.9.7
2023.*
2023.1.0
2023.1.1
2023.1.2
2023.1.3
2023.1.4
2023.1.5
2023.1.6
2023.1.7
2023.10.0
2023.10.1
2023.10.2
2023.10.3
2023.10.4
2023.10.5
2023.11.0
2023.11.1
2023.11.2
2023.11.3
2023.12.0
2023.12.1
2023.12.2
2023.12.3
2023.12.4
2023.2.0
2023.2.1
2023.2.2
2023.2.3
2023.2.4
2023.2.5
2023.3.0
2023.3.1
2023.3.2
2023.3.3
2023.3.4
2023.3.5
2023.3.6
2023.4.0
2023.4.1
2023.4.2
2023.4.3
2023.4.4
2023.4.5
2023.4.6
2023.5.0
2023.5.1
2023.5.2
2023.5.3
2023.5.4
2023.6.0
2023.6.1
2023.6.2
2023.6.3
2023.7.0
2023.7.1
2023.7.2
2023.7.3
2023.8.0
2023.8.1
2023.8.2
2023.8.3
2023.8.4
2023.9.0
2023.9.1
2023.9.2
2023.9.3
2024.*
2024.1.0
2024.1.1
2024.1.2
2024.1.3
2024.1.4
2024.1.5
2024.1.6
2024.10.0
2024.10.1
2024.10.2
2024.10.3
2024.11.0
2024.11.1
2024.11.2
2024.11.3
2024.12.0
2024.12.1
2024.12.2
2024.12.3
2024.12.4
2024.12.5
2024.2.0
2024.2.1
2024.2.2
2024.2.3
2024.2.4
2024.2.5
2024.3.0
2024.3.1
2024.3.2
2024.3.3
2024.4.0
2024.4.1
2024.4.2
2024.4.3
2024.4.4
2024.5.0
2024.5.1
2024.5.2
2024.5.3
2024.5.4
2024.5.5
2024.6.0
2024.6.1
2024.6.2
2024.6.3
2024.6.4
2024.7.0
2024.7.1
2024.7.2
2024.7.3
2024.7.4
2024.8.0
2024.8.1
2024.8.2
2024.8.3
2024.9.0
2024.9.1
2024.9.2
2024.9.3
2024.9.4
2025.*
2025.1.0
2025.1.1
2025.1.2
2025.1.3
2025.1.4
2025.10.0
2025.10.1
2025.10.2
2025.10.3
2025.10.4
2025.11.0
2025.11.1
2025.11.2
2025.11.3
2025.12.0
2025.12.1
2025.12.2
2025.12.3
2025.12.4
2025.12.5
2025.2.0
2025.2.1
2025.2.2
2025.2.3
2025.2.4
2025.2.5
2025.3.0
2025.3.1
2025.3.2
2025.3.3
2025.3.4
2025.4.0
2025.4.1
2025.4.2
2025.4.3
2025.4.4
2025.5.0
2025.5.1
2025.5.2
2025.5.3
2025.6.0
2025.6.1
2025.6.2
2025.6.3
2025.7.0
2025.7.1
2025.7.2
2025.7.3
2025.7.4
2025.8.0
2025.8.1
2025.8.2
2025.8.3
2025.9.0
2025.9.1
2025.9.2
2025.9.3
2025.9.4
2026.*
2026.1.0
2026.1.1
2026.1.2
2026.1.3
2026.2.0
2026.2.1
2026.2.2
2026.2.3
2026.3.0
2026.3.1
2026.3.2
2026.3.3
2026.3.4
2026.4.0
2026.4.1
2026.4.2
2026.4.3
2026.4.4
Other
Last-Python2-release
mac/2020.*
mac/2020.6/10
mac/2020.6/13
mac/2020.6/6
mac/2020.6/9
mac/2020.7/1
mac/2020.7/2
release/2020.*
release/2020.7/10
release/2020.7/11
release/2020.7/3
release/2020.7/4
release/2020.7/5
release/2020.7/6
release/2020.7/7
release/2020.7/8
release/2020.7/9
release/2021.*
release/2021.1/1
release/2021.1/5
release/2021.1/6
release/2021.10/2021.230
release/2021.10/2021.238
release/2021.10/2021.243
release/2021.10/2021.246
release/2021.10/2021.247
release/2021.11/2021.261
release/2021.11/2021.262
release/2021.12/2021.278
release/2021.12/2021.284
release/2021.12/2021.294
release/2021.12/2021.306
release/2021.12/2021.312
release/2021.12/2021.315
release/2021.12/2021.321
release/2021.12/2021.322
release/2021.2/1
release/2021.2/10
release/2021.2/11
release/2021.2/13
release/2021.2/2021.25
release/2021.2/2021.34
release/2021.2/2021.38
release/2021.2/2021.39
release/2021.3/2021.54
release/2021.3/2021.65
release/2021.3/2021.71
release/2021.3/2021.76
release/2021.3/2021.77
release/2021.4/2021.100
release/2021.4/2021.113
release/2021.4/2021.92
release/2021.5/2021.126
release/2021.5/2021.128
release/2021.5/2021.134
release/2021.5/2021.142
release/2021.5/2021.150
release/2021.6/2021.156
release/2021.6/2021.158
release/2021.7/2021.172
release/2021.7/2021.177
release/2021.7/2021.196
release/2021.7/2021.200
release/2021.7/2021.202
release/2021.8/2021.208
release/2021.8/2021.212
release/2021.8/2021.216
release/2022.*
release/2022.10/2022.398
release/2022.11/2022.414
release/2022.2/2022.343
release/2022.2/2022.345
release/2022.3/2022.355
release/2022.3/2022.356
release/2022.3/2022.358
release/2022.6/2022.366
release/2022.6/2022.375
release/2022.6/2022.385
release/2022.8/2022.387
release/2023.*
release/2023.12/2023.499
release/2023.2/2023.443
release/2023.2/2023.444
release/2023.4/2023.460
release/2023.7/2023.471
release/2024.*
release/2024.1/2024.535
release/2024.12.2/2024.1048
release/2024.12/2024.1032
release/2024.2/2024.561
release/2024.3/2024.608
release/2024.4/2024.624
release/2024.5.1/2024.688
release/2024.5/2024.678
release/2024.6/2024.696
release/2024.7/2024.730
release/2024.8/2024.783
release/2024.9.2/2024.881
release/2025.*
release/2025.1/2025.1073
release/2025.10.0/1444
release/2025.11.2/1537
release/2025.2/2025.1178
release/2025.3/2025.1200
release/2025.3/2025.1205
release/2025.5/2025.1264
release/2025.6/2025.1305
release/2026.*
release/2026.2.1/2026.1766
release/2026.4.1/2026.1904
release/2026.4/2026.1862
testflight/1.*
testflight/1.0.1/1
testflight/1.0.2/2
testflight/1.0.2/55
testflight/1.0.3/2
testflight/1.0.3/3
testflight/1.0.4/2
testflight/1.0.4/3
testflight/1.0.4/4
testflight/1.0/39
testflight/1.0/40
testflight/1.0/41
testflight/1.0/42
testflight/1.0/43
testflight/1.0/44
testflight/1.0/45
testflight/1.0/46
testflight/1.0/47
testflight/1.0/48
testflight/1.0/49
testflight/1.0/50
testflight/1.0/51
testflight/1.0/52
testflight/1.0/53
testflight/1.0/54
testflight/1.1.0/1
testflight/1.1.0/2
testflight/1.1.0/3
testflight/1.1.1/1
testflight/1.1.1/2
testflight/1.1.1/5
testflight/1.1.2/1
testflight/1.1.2/10
testflight/1.1.2/9
testflight/1.2.0/11
testflight/1.2.0/14
testflight/1.2.0/15
testflight/1.2.0/16
testflight/1.2.0/17
testflight/1.2.0/19
testflight/1.2.0/20
testflight/1.2.0/21
testflight/1.2.0/22
testflight/1.2.0/23
testflight/1.2.0/24
testflight/1.2.0/25
testflight/1.2.0/26
testflight/1.2.0/27
testflight/1.2.0/28
testflight/1.2.0/29
testflight/1.2.0/30
testflight/1.2.0/31
testflight/1.2.0/32
testflight/1.2.0/33
testflight/1.2.0/34
testflight/1.2.0/35
testflight/1.2.0/36
testflight/1.2.0/6
testflight/1.2.0/7
testflight/1.2.0/8
testflight/1.5.0/10
testflight/1.5.0/23
testflight/1.5.0/27
testflight/1.5.0/28
testflight/1.5.0/3
testflight/1.5.0/30
testflight/1.5.0/31
testflight/1.5.0/32
testflight/1.5.0/33
testflight/1.5.0/34
testflight/1.5.0/35
testflight/1.5.0/4
testflight/1.5.0/5
testflight/1.5.0/6
testflight/1.5.0/8
testflight/1.5.0/9
testflight/1.5.1/1
testflight/1.5.1/2
testflight/1.5.1/3
testflight/1.5.1/4
testflight/2.*
testflight/2.0.0/4
testflight/2.0.0/5
testflight/2.0.0/6
testflight/2.0.0/7
testflight/2.0.0/70
testflight/2.0.0/8
testflight/2020.*
testflight/2020.1/3
testflight/2020.1/4
testflight/2020.1/5
testflight/2020.1/6
testflight/2020.2/4
testflight/2020.2/5
testflight/2020.3.1/1
testflight/2020.3/1
testflight/2020.3/2
testflight/2020.3/3
testflight/2020.3/4
testflight/2020.3/5
testflight/2020.4.1/1
testflight/2020.4/1
testflight/2020.4/2
testflight/2020.4/3
testflight/2020.4/4
testflight/2020.4/5
testflight/2020.4/7
testflight/2020.4/8
testflight/2020.5/1
testflight/2020.5/2
testflight/2020.5/3
testflight/2020.5/5
testflight/2020.5/6
testflight/2020.5/7
testflight/2020.6/1
testflight/2020.6/11
testflight/2020.6/12
testflight/2020.6/14
testflight/2020.6/2
testflight/2020.6/4
testflight/2020.6/5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66061.json"