Overview
A high-severity vulnerability has been disclosed in the Home Assistant iOS Companion App that allows an attacker to remotely trigger NFC and QR tag-based automations without physical proximity to the tag. Tracked as CVE-2026-66061 with a CVSS score of 7.1 (High), the flaw stems from the app's failure to distinguish between a physically scanned tag and a tag link delivered through iOS universal links.
The vulnerability was published on August 7, 2026. Home Assistant users who rely on NFC tags or QR codes to control smart home automations — door unlocking, alarm disarming, or security-sensitive routines — should update immediately.
Vulnerability Details
Home Assistant's iOS Companion App supports tag links that trigger automations when a physical NFC tag is scanned or a QR code is read. These tag links follow a specific URL format that the OS routes to the app.
The vulnerability is that the app treats any tag link that arrives via iOS universal links (e.g., a crafted URL sent via message, email, or web page) as if it were a physically scanned tag, with no validation of the delivery mechanism. This is a classic origin confusion flaw: the app cannot tell the difference between:
- A tag genuinely scanned by the camera or NFC reader (physical proximity required), and
- A tag URL delivered remotely through the OS routing layer (no physical proximity required)
An attacker who knows the tag URL format — which follows a predictable Home Assistant schema — can craft a universal link that, when clicked by the victim, silently triggers any automation associated with that tag.
Attack Scenario
- Attacker discovers or enumerates a victim's Home Assistant tag URL (e.g., through an exposed instance, social engineering, or network observation)
- Attacker sends the crafted universal link to the victim via any channel (iMessage, email, a web link)
- Victim's iPhone, upon clicking the link, routes it to the Home Assistant app
- The app treats the link as a legitimate tag scan and triggers the associated automation
- Result: remote execution of any tag-based automation — potentially unlocking doors, disarming alarms, or triggering other security-critical routines
CVSS Breakdown
| Metric | Value |
|---|---|
| Base Score | 7.1 High |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Unchanged |
Affected Products
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Home Assistant iOS Companion App | Prior to 2026.5.0 | 2026.5.0 |
Impact
The severity of impact depends heavily on what automations are associated with NFC/QR tags in the victim's Home Assistant setup:
- Physical security bypass: If tags control door locks, gate openers, or garage doors, an attacker could trigger entry remotely
- Security system interaction: Tag-linked alarm disarm sequences could be triggered without the user's presence
- Privacy exposure: Automations that reveal occupancy status, camera feeds, or other home data could be remotely activated
- Social engineering amplifier: Combined with phishing, the attack can be made invisible to the victim
Remediation
Update the Home Assistant iOS App
Update to version 2026.5.0 or later through the App Store. This version adds validation of the delivery mechanism for tag links, rejecting any tag link that was not delivered through a genuine physical scan.
Interim Mitigations
If an immediate update is not possible:
- Avoid using NFC/QR tags for security-sensitive automations (door locks, alarm systems) until patched
- Review your tag-linked automations and consider adding confirmation dialogs or secondary authentication requirements for high-impact routines
- Enable Home Assistant notifications so you are alerted when automations fire unexpectedly
- Restrict companion app exposure: Ensure your Home Assistant instance is not publicly accessible without authentication
Detection
Review your Home Assistant automation history (Settings > Automations & Scenes > Logbook) for any tag-triggered automations that fired at unexpected times or without your physical presence at the tag location.
Context
NFC and QR tag-based automation is a popular feature for hands-free smart home control. This vulnerability highlights an important design assumption: tag links should be treated as proximity-sensitive actions, requiring validation that the delivery channel reflects genuine physical interaction. The fix in 2026.5.0 enforces this boundary at the OS routing layer.
Home Assistant is one of the most widely deployed self-hosted smart home platforms globally, with tens of millions of active installations.