CVE-2026-55844

highCVSS 7.5covered by 1 sourcefirst seen 2026-06-29

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.

⚡ Watch CVE-2026-55844

Get an email if CVE-2026-55844 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-55844: Home Assistant is open source home automation software that puts local control and privacy fir…nvd · 2026-06-29

External references

NVD record for CVE-2026-55844

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-55844 status](https://www.csirts.com/badge/CVE-2026-55844)](https://www.csirts.com/cve/CVE-2026-55844)