CVE-2026-55844

The record

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever the app cannot find any other URL to be used, it fallbacks to the internal URL as well, which can expose user's token when connected to a not secure network. This vulnerability is fixed in 2025.5.0.

Affected packages

Related vulnerabilities

• CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because… CWE-319
• CVE-2026-115495 Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile… CWE-319
• CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability… CWE-319
• CVE-2026-116196 Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that… CWE-319
• CVE-2026-116200 Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap()… CWE-319
• CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never… CWE-319
• CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. CWE-319
• CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may… CWE-319