Open source home automation that puts local control and privacy first.
[email protected] has vulnerabilities — update to latest
Update to >= 2023.9.0 to fix known vulnerabilities
| Severity | ID | Summary | Fixed in |
|---|---|---|---|
| medium | CVE-2023-50715 | User accounts disclosed to unauthenticated actors on the LAN | 2023.12.3 |
| high | CVE-2025-25305 | Home Assistant does not correctly validate SSL for outgoing requests in core and used libs | 2024.1.6 |
| medium | CVE-2025-65713 | Home Assistant Core before is vulnerable to Directory Traversal | 2025.8.0 |
| medium | CVE-2023-41893 | Home Assistant vulnerable to account takeover via auth_callback login | 2023.9.0 |
| low | CVE-2026-33044 | Home Assistant has stored XSS in Map-card through malicious device name | 2026.01 |
| medium | CVE-2023-41893 | Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to | 2023.9.0 |
Get this data programmatically — free, no authentication.
curl https://depscope.dev/api/check/conda/homeassistantFirst published · 2021-10-01 00:53:27.549000+00:00
Last updated · 2025-04-22 14:58:01.617000+00:00