{"id":"CVE-2026-66061","summary":"Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution","details":"Home Assistant is open source home automation software focused on local control and privacy.  Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.","aliases":["GHSA-j23v-9672-677j"],"modified":"2026-08-09T03:46:07.283896632Z","published":"2026-08-07T20:43:41.785Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66061.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66061.json"},{"type":"ADVISORY","url":"https://github.com/home-assistant/core/security/advisories/GHSA-j23v-9672-677j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66061"},{"type":"FIX","url":"https://github.com/home-assistant/iOS/commit/45e05e6666c74fdbea44cc4d6fb103043fff6fd9"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/home-assistant/core","events":[{"introduced":"0"},{"fixed":"b10582b0a906658ca1f2424d9fb3b7149f066fa4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2026.5.0"}],"source":"AFFECTED_FIELD"}},{"type":"GIT","repo":"https://github.com/home-assistant/ios","events":[{"introduced":"0"},{"fixed":"45e05e6666c74fdbea44cc4d6fb103043fff6fd9"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2026.4.4","2026.4.3","2026.4.2","2026.4.1","2026.4.0","2026.3.4","2026.3.3","2026.3.2","2026.3.1","2026.3.0","2026.2.3","2026.2.2","2026.2.1","2026.2.0","2026.1.3","2026.1.2","2026.1.1","2026.1.0","2025.12.5","2025.12.4","2025.12.3","2025.12.2","2025.12.1","2025.12.0","2025.11.3","2025.11.2","2025.11.1","2025.11.0","2025.10.4","2025.10.3","2025.10.2","2025.10.1","2025.10.0","2025.9.4","2025.9.3","2025.9.2","2025.9.1","2025.9.0","2025.8.3","2025.8.2","2025.8.1","2025.8.0","2025.7.4","2025.7.3","2025.7.2","2025.7.1","2025.7.0","2025.6.3","2025.6.2","2025.6.1","2025.6.0","2025.5.3","2025.5.2","2025.5.1","2025.5.0","2025.4.4","2025.4.3","2025.4.2","2025.4.1","2025.4.0","2025.3.4","2025.3.3","2025.3.2","2025.3.1","2025.3.0","2025.2.5","2025.2.4","2025.2.3","2025.2.2","2025.2.1","2025.2.0","2025.1.4","2025.1.3","2025.1.2","2025.1.1","2025.1.0","2024.12.5","2024.12.4","2024.12.3","2024.12.2","2024.12.1","2024.12.0","2024.11.3","2024.11.2","2024.11.1","2024.11.0","2024.10.3","2024.10.2","2024.10.1","2024.10.0","2024.9.3","2024.9.2","2024.9.1","2024.9.0","2024.8.3","2024.8.2","2024.8.1","2024.8.0","2024.7.4","2024.7.3","2024.7.2","2024.7.1","2024.7.0","2024.6.4","2024.6.3","2024.6.2","2024.6.1","2024.6.0","2024.5.5","2024.5.4","2024.5.3","2024.5.2","2024.5.1","2024.5.0","2024.4.4","2024.4.3","2024.4.2","2024.4.1","2024.4.0","2024.3.3","2024.3.2","2024.3.1","2024.3.0","2024.2.5","2024.2.4","2024.2.3","2024.2.2","2024.2.1","2024.2.0","2024.1.6","2024.1.5","2024.1.4","2024.1.3","2024.1.2","2024.1.1","2024.1.0","2023.12.4","2023.12.3","2023.12.2","2023.12.1","2023.12.0","2023.11.3","2023.11.2","2023.11.1","2023.11.0","2023.10.5","2023.10.4","2023.10.3","2023.10.2","2023.10.1","2023.10.0","2023.9.3","2023.9.2","2023.9.1","2023.9.0","2023.8.4","2023.8.3","2023.8.2","2023.8.1","2023.8.0","2023.7.3","2023.7.2","2023.7.1","2023.7.0","2023.6.3","2023.6.2","2023.6.1","2023.6.0","2023.5.4","2023.5.3","2023.5.2","2023.5.1","2023.5.0","2023.4.6","2023.4.5","2023.4.4","2023.4.3","2023.4.2","2023.4.1","2023.4.0","2023.3.6","2023.3.5","2023.3.4","2023.3.3","2023.3.2","2023.3.1","2023.3.0","2023.2.5","2023.2.4","2023.2.3","2023.2.2","2023.2.1","2023.2.0","2023.1.7","2023.1.6","2023.1.5","2023.1.4","2023.1.3","2023.1.2","2023.1.1","2023.1.0","2022.12.9","2022.12.8","2022.12.7","2022.12.6","2022.12.5","2022.12.4","2022.12.3","2022.12.2","2022.12.1","2022.12.0","2022.11.5","2022.11.4","2022.11.3","2022.11.2","2022.11.1","2022.11.0","2022.10.5","2022.10.4","2022.10.3","2022.10.2","2022.10.1","2022.10.0","2022.9.7","2022.9.6","2022.9.5","2022.9.4","2022.9.3","2022.9.2","2022.9.1","2022.9.0","2022.8.7","2022.8.6","2022.8.5","2022.8.4","2022.8.3","2022.8.2","2022.8.1","2022.8.0","2022.7.7","2022.7.6","2022.7.5","2022.7.4","2022.7.3","2022.7.2","2022.7.1","2022.7.0","2022.6.7","2022.6.6","2022.6.5","2022.6.4","2022.6.3","2022.6.2","2022.6.1","2022.6.0","2022.5.5","2022.5.4","2022.5.3","2022.5.2","2022.5.1","2022.5.0","2022.4.7","2022.4.6","2022.4.5","2022.4.4","2022.4.3","2022.4.2","2022.4.1","2022.4.0","2022.3.8","2022.3.7","2022.3.6","2022.3.5","2022.3.4","2022.3.3","2022.3.2","2022.3.1","2022.3.0","2022.2.9","2022.2.8","2022.2.7","2022.2.6","2022.2.5","2022.2.4","2022.2.3","2022.2.2","2022.2.1","2022.2.0","2021.12.10","2021.12.9","2021.12.8","2021.12.7","2021.12.6","2021.12.5","2021.12.4","2021.12.3","2021.12.2","2021.12.1","2021.12.0","2021.11.5","2021.11.4","2021.11.3","2021.11.2","2021.11.1","2021.11.0","2021.10.7","2021.10.6","2021.10.5","2021.10.4","2021.10.3","2021.10.2","2021.10.1","2021.10.0","2021.9.7","2021.9.6","2021.9.5","2021.9.4","2021.9.3","2021.9.2","2021.9.1","2021.9.0","2021.8.8","2021.8.7","2021.8.6","2021.8.5","2021.8.4","2021.8.3","2021.8.2","2021.8.1","2021.8.0","2021.7.4","2021.7.3","2021.7.2","2021.7.1","2021.7.0","2021.6.6","2021.6.5","2021.6.4","2021.6.3","2021.6.2","2021.6.1","2021.6.0","2021.5.5","2021.5.4","2021.5.3","2021.5.2","2021.5.1","2021.5.0","2021.4.6","2021.4.5","2021.4.4","2021.4.3","2021.4.2","2021.4.1","2021.4.0","2021.3.4","2021.3.3","2021.3.2","2021.3.1","2021.3.0","2021.2.3","2021.2.2","2021.2.1","2021.2.0","2021.1.5","2021.1.4","2021.1.3","2021.1.2","2021.1.1","2021.1.0","2020.12.2","2020.12.1","2020.12.0","0.118.5","0.118.4","0.118.3","0.118.2","0.118.1","0.118.0","0.117.6","0.117.5","0.117.4","0.117.3","0.117.2","0.117.1","0.117.0","0.116.4","0.116.3","0.116.2","0.116.1","0.116.0","0.115.6","0.115.5","0.115.4","0.115.3","0.115.2","0.115.1","0.115.0","0.114.4","0.114.3","0.114.2","0.114.1","0.114.0","0.113.3","0.113.2","0.113.1","0.113.0","0.112.5","0.112.4","0.112.3","0.112.2","0.112.1","0.112.0","0.111.4","0.111.3","0.111.2","0.111.1","0.111.0","0.110.7","0.110.6","0.110.5","0.110.4","0.110.3","0.110.2","0.110.1","0.110.0","0.109.6","0.109.5","0.109.4","0.109.3","0.109.2","0.109.1","0.109.0","0.108.9","0.108.8","0.108.7","0.108.6","0.108.5","0.108.4","0.108.3","0.108.2","0.108.1","0.108.0","0.107.7","0.107.6","0.107.5","0.107.4","0.107.3","0.107.2","0.107.1","0.107.0","0.106.6","0.106.5","0.106.4","0.106.3","0.106.2","0.106.1","0.106.0","0.105.5","0.105.4","0.105.3","0.105.2","0.105.1","0.105.0","0.104.3","0.104.2","0.104.1","0.104.0","0.103.6","0.103.5","0.103.4","0.103.3","0.103.2","0.103.1","0.103.0","0.103.0b1","0.103.0b0","0.81.1","0.28","0.7.6","Last-Python2-release","release/2026.4.1/2026.1904","release/2026.4/2026.1862","release/2026.2.1/2026.1766","release/2025.11.2/1537","release/2025.10.0/1444","release/2025.6/2025.1305","release/2025.5/2025.1264","release/2025.3/2025.1205","release/2025.3/2025.1200","release/2025.2/2025.1178","release/2025.1/2025.1073","release/2024.12.2/2024.1048","release/2024.12/2024.1032","2024.9.4","release/2024.9.2/2024.881","release/2024.8/2024.783","release/2024.7/2024.730","release/2024.6/2024.696","release/2024.5.1/2024.688","release/2024.5/2024.678","release/2024.4/2024.624","release/2024.3/2024.608","release/2024.2/2024.561","release/2024.1/2024.535","release/2023.12/2023.499","release/2023.7/2023.471","release/2023.4/2023.460","release/2023.2/2023.444","release/2023.2/2023.443","release/2022.10/2022.398","release/2022.11/2022.414","release/2022.8/2022.387","release/2022.6/2022.385","release/2022.6/2022.375","release/2022.6/2022.366","release/2022.3/2022.358","release/2022.3/2022.356","release/2022.3/2022.355","release/2022.2/2022.345","release/2022.2/2022.343","release/2021.12/2021.322","release/2021.12/2021.321","release/2021.12/2021.315","release/2021.12/2021.312","release/2021.12/2021.306","release/2021.12/2021.294","release/2021.12/2021.284","release/2021.12/2021.278","release/2021.11/2021.262","release/2021.11/2021.261","release/2021.10/2021.247","release/2021.10/2021.246","release/2021.10/2021.243","release/2021.10/2021.238","release/2021.10/2021.230","release/2021.8/2021.216","release/2021.8/2021.212","release/2021.8/2021.208","release/2021.7/2021.202","release/2021.7/2021.200","release/2021.7/2021.196","release/2021.7/2021.177","release/2021.7/2021.172","release/2021.6/2021.158","release/2021.6/2021.156","release/2021.5/2021.150","release/2021.5/2021.142","release/2021.5/2021.134","release/2021.5/2021.128","release/2021.5/2021.126","release/2021.4/2021.113","release/2021.4/2021.100","release/2021.4/2021.92","release/2021.3/2021.77","release/2021.3/2021.76","release/2021.3/2021.71","release/2021.3/2021.65","release/2021.3/2021.54","release/2021.2/2021.39","release/2021.2/2021.38","release/2021.2/2021.34","release/2021.2/2021.25","release/2021.2/13","release/2021.2/11","release/2021.2/10","release/2021.1/6","release/2021.2/1","release/2021.1/5","release/2021.1/1","release/2020.7/11","release/2020.7/10","release/2020.7/9","release/2020.7/8","release/2020.7/7","release/2020.7/6","release/2020.7/5","release/2020.7/4","release/2020.7/3","mac/2020.7/2","mac/2020.7/1","testflight/2020.6/14","mac/2020.6/13","testflight/2020.6/12","testflight/2020.6/11","mac/2020.6/10","mac/2020.6/9","mac/2020.6/6","testflight/2020.6/5","testflight/2020.6/4","testflight/2020.6/2","testflight/2020.6/1","testflight/2020.5/7","testflight/2020.5/6","testflight/2020.5/5","testflight/2020.5/3","testflight/2020.5/2","testflight/2020.5/1","testflight/2020.4.1/1","testflight/2020.4/8","testflight/2020.4/7","testflight/2020.4/5","testflight/2020.4/4","testflight/2020.4/3","testflight/2020.4/2","testflight/2020.3.1/1","testflight/2020.4/1","testflight/2020.3/5","testflight/2020.3/4","testflight/2020.3/3","testflight/2020.3/2","testflight/2020.3/1","testflight/2020.2/5","testflight/2020.2/4","testflight/2020.1/6","testflight/2020.1/5","testflight/2020.1/4","testflight/2020.1/3","testflight/2.0.0/70","2019.1","testflight/1.5.1/4","testflight/1.5.1/3","testflight/1.5.1/2","testflight/1.5.1/1","testflight/1.5.0/34","testflight/1.5.0/35","testflight/1.5.0/33","testflight/1.5.0/32","testflight/1.5.0/31","testflight/1.5.0/30","testflight/1.5.0/28","testflight/1.5.0/27","testflight/1.5.0/23","testflight/1.5.0/10","testflight/2.0.0/8","testflight/2.0.0/7","testflight/2.0.0/6","testflight/2.0.0/5","testflight/1.5.0/9","testflight/1.5.0/8","testflight/1.5.0/6","testflight/1.5.0/5","testflight/2.0.0/4","testflight/1.5.0/4","testflight/1.5.0/3","testflight/1.2.0/36","testflight/1.2.0/35","testflight/1.2.0/34","testflight/1.2.0/33","testflight/1.2.0/32","testflight/1.2.0/31","testflight/1.2.0/30","testflight/1.2.0/29","testflight/1.2.0/28","testflight/1.2.0/27","testflight/1.2.0/26","testflight/1.2.0/25","testflight/1.2.0/24","testflight/1.2.0/23","testflight/1.2.0/22","testflight/1.2.0/21","testflight/1.2.0/20","testflight/1.2.0/19","testflight/1.2.0/17","testflight/1.2.0/16","testflight/1.2.0/15","testflight/1.2.0/14","testflight/1.2.0/11","testflight/1.2.0/8","testflight/1.2.0/7","testflight/1.2.0/6","testflight/1.1.2/10","testflight/1.1.2/9","testflight/1.1.2/1","testflight/1.1.1/5","testflight/1.1.1/2","testflight/1.1.1/1","testflight/1.1.0/3","testflight/1.1.0/2","testflight/1.1.0/1","testflight/1.0.4/4","testflight/1.0.4/3","testflight/1.0.4/2","testflight/1.0.3/3","testflight/1.0.3/2","testflight/1.0.2/2","testflight/1.0.2/55","testflight/1.0.1/1","testflight/1.0/54","testflight/1.0/53","testflight/1.0/52","testflight/1.0/51","testflight/1.0/50","testflight/1.0/49","testflight/1.0/48","testflight/1.0/47","testflight/1.0/46","testflight/1.0/45","testflight/1.0/44","testflight/1.0/43","testflight/1.0/42","testflight/1.0/41","testflight/1.0/40","testflight/1.0/39"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66061.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}