Information on Home Assistant's security policies and guidelines can be found on our website:
Repository navigation
Security: home-assistant/core
Security
SECURITY.md
-
mDNS Server-Side Request ForgeryGHSA-4ghv-53cq-7wp3 published
Sep 16, 2026 by JC0liverModerate -
Stored XSS in graph tooltip from entity nameGHSA-mq77-rv97-285m published
Oct 14, 2025 by bramkragtenHigh -
SSL validation for outgoing requests in core and used libs not correctGHSA-m3pm-rpgg-5wj6 published
Feb 18, 2025 by MartinHjelmareHigh -
User accounts disclosed to unauthenticated actors on the LANGHSA-jqpc-rc7g-vf83 published
Dec 14, 2023 by frenckModerate -
iOS Companion App 2023.471 ignores internal SSID allowlist for connections – possible leak of access token and sensor dataGHSA-cm5v-547m-qh5h published
Jun 25, 2026 by JC0liverHigh -
Account takeover via auth_callback loginGHSA-qhhj-7hrc-gqj5 published
Oct 19, 2023 by frenckLow -
Full takeover via javascript URI in auth_callback loginGHSA-jvxq-x42r-f7mv published
Oct 19, 2023 by frenckCritical -
Local-only webhooks externally accessible via SniTunGHSA-wx3j-3v2j-rf45 published
Oct 19, 2023 by frenckLow -
Fake WS server installation permits full takeoverGHSA-cr83-q7r2-7f5q published
Oct 19, 2023 by frenckCritical -
Lack of XFO header allows clickjackingGHSA-935v-rmg9-44mw published
Oct 19, 2023 by frenckCritical
Learn more about advisories related to home-assistant/core in the GitHub Advisory Database