Critical Vulnerability in Home Assistant Apps Allows User Takeover

Heise.De

Critical Vulnerability in Home Assistant Apps Allows User Takeover

First seen 1 Jun 2026, 15:24 UTC • •72.0

Article Content

1 / 3

Browse articles

ThreatCluster •June 2, 2026 at 14:57 UTC

•CVE-2026-44698 exposes a critical vulnerability in Home Assistant apps for Android and iOS.
•Attackers can exploit the flaw to take over user instances by intercepting access tokens.
•Users must update to the latest app versions or remove third-party webpage cards to mitigate risks.

A security vulnerability in the Home Assistant companion apps for Android and iOS allows attackers to intercept access tokens, enabling full control over user instances. The flaw, identified as CVE-2026-44698, has a CVSS score of 8.3, indicating a high risk. Attackers can exploit this vulnerability through Cross-Origin IFrame Token Exfiltration via JavaScript, where a malicious iframe can execute arbitrary code and extract the logged-in user's access token. Users of the affected apps are advised to update to versions 2026.4.1 for iOS and 2026.4.4 for Android to mitigate the risk. If unable to update, users should remove any webpage cards from their dashboards that link to third-party sites. The vulnerability was publicly disclosed on May 29, 2026, following a security advisory from the developers.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 136d ago How this analysis works

Timeline

2026-05-29

CVE-2026-44698 published

The vulnerability was disclosed, allowing attackers to exploit access tokens in Home Assistant apps.

2026-06-01

Security advisory issued

Heise.De reported on the vulnerability, urging users to update their apps immediately to prevent takeovers.

More articles in this cluster (2)

Threat Graph

9 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
T1041 - Exfiltration Over C2 Channel
T1059.007 - JavaScript
T1567 - Exfiltration Over Web Service

Vulnerability (1)

CVE-2026-44698

Weakness (2)

CWE-200 - Exposure of Sensitive Information
CWE-94 - Code Injection

Affected Platform (2)

Android
IOS

Relationships

CVE-2026-44698 targets Android
CVE-2026-44698 targets IOS
Data Breach targets Android
Data Breach targets IOS
T1041 - Exfiltration Over C2 Channel targets Android
T1041 - Exfiltration Over C2 Channel targets IOS
T1059.007 - JavaScript targets Android
T1059.007 - JavaScript targets IOS
T1567 - Exfiltration Over Web Service targets Android
T1567 - Exfiltration Over Web Service targets IOS
CVE-2026-44698 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-44698 related to CWE-94 - Code Injection

Following this threat?

Track CVE-2026-44698 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…