Skip to main content
COSMICBYTEZLABS
NewsSecurityHOWTOsToolsTraining
StudyProjectsNewsletterHire MeAbout
Subscribe

Press Enter to search or Esc to close

News
Security
HOWTOs
Tools
Training
Study
Projects
Newsletter
Hire Me
About
RSS Feed
Reading List
Subscribe

Stay in the Loop

Get the latest security alerts, tutorials, and tech insights delivered to your inbox.

Subscribe NowFree forever. No spam.
COSMICBYTEZLABS

Your trusted source for IT intelligence, cybersecurity insights, and hands-on technical guides.

2265+ Articles
157+ Guides

CONTENT

  • Latest News
  • Security Alerts
  • HOWTOs
  • Checklists
  • Projects
  • Exam Prep

RESOURCES

  • Search
  • Browse Tags
  • Newsletter Archive
  • Reading List
  • RSS Feed

COMPANY

  • About Us
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CosmicBytez Labs. All rights reserved.

System Status: Operational
  1. Home
  2. Security
  3. CVE-2026-66061: Home Assistant iOS App NFC Tag Spoofing via Universal Links
CVE-2026-66061: Home Assistant iOS App NFC Tag Spoofing via Universal Links
SECURITYHIGHCVE-2026-66061

CVE-2026-66061: Home Assistant iOS App NFC Tag Spoofing via Universal Links

The Home Assistant iOS Companion app prior to 2026.5.0 fails to validate whether NFC or QR tag links arrive via physical scan or iOS universal link, allowing an attacker to remotely trigger tag-based automations without physical proximity.

Dylan H.

Security Team

August 8, 2026
4 min read

Affected Products

  • Home Assistant iOS Companion App < 2026.5.0

Overview

A high-severity vulnerability has been disclosed in the Home Assistant iOS Companion App that allows an attacker to remotely trigger NFC and QR tag-based automations without physical proximity to the tag. Tracked as CVE-2026-66061 with a CVSS score of 7.1 (High), the flaw stems from the app's failure to distinguish between a physically scanned tag and a tag link delivered through iOS universal links.

The vulnerability was published on August 7, 2026. Home Assistant users who rely on NFC tags or QR codes to control smart home automations — door unlocking, alarm disarming, or security-sensitive routines — should update immediately.

Vulnerability Details

Home Assistant's iOS Companion App supports tag links that trigger automations when a physical NFC tag is scanned or a QR code is read. These tag links follow a specific URL format that the OS routes to the app.

The vulnerability is that the app treats any tag link that arrives via iOS universal links (e.g., a crafted URL sent via message, email, or web page) as if it were a physically scanned tag, with no validation of the delivery mechanism. This is a classic origin confusion flaw: the app cannot tell the difference between:

  • A tag genuinely scanned by the camera or NFC reader (physical proximity required), and
  • A tag URL delivered remotely through the OS routing layer (no physical proximity required)

An attacker who knows the tag URL format — which follows a predictable Home Assistant schema — can craft a universal link that, when clicked by the victim, silently triggers any automation associated with that tag.

Attack Scenario

  1. Attacker discovers or enumerates a victim's Home Assistant tag URL (e.g., through an exposed instance, social engineering, or network observation)
  2. Attacker sends the crafted universal link to the victim via any channel (iMessage, email, a web link)
  3. Victim's iPhone, upon clicking the link, routes it to the Home Assistant app
  4. The app treats the link as a legitimate tag scan and triggers the associated automation
  5. Result: remote execution of any tag-based automation — potentially unlocking doors, disarming alarms, or triggering other security-critical routines

CVSS Breakdown

MetricValue
Base Score7.1 High
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged

Affected Products

ProductAffected VersionsFixed Version
Home Assistant iOS Companion AppPrior to 2026.5.02026.5.0

Impact

The severity of impact depends heavily on what automations are associated with NFC/QR tags in the victim's Home Assistant setup:

  • Physical security bypass: If tags control door locks, gate openers, or garage doors, an attacker could trigger entry remotely
  • Security system interaction: Tag-linked alarm disarm sequences could be triggered without the user's presence
  • Privacy exposure: Automations that reveal occupancy status, camera feeds, or other home data could be remotely activated
  • Social engineering amplifier: Combined with phishing, the attack can be made invisible to the victim

Remediation

Update the Home Assistant iOS App

Update to version 2026.5.0 or later through the App Store. This version adds validation of the delivery mechanism for tag links, rejecting any tag link that was not delivered through a genuine physical scan.

Interim Mitigations

If an immediate update is not possible:

  • Avoid using NFC/QR tags for security-sensitive automations (door locks, alarm systems) until patched
  • Review your tag-linked automations and consider adding confirmation dialogs or secondary authentication requirements for high-impact routines
  • Enable Home Assistant notifications so you are alerted when automations fire unexpectedly
  • Restrict companion app exposure: Ensure your Home Assistant instance is not publicly accessible without authentication

Detection

Review your Home Assistant automation history (Settings > Automations & Scenes > Logbook) for any tag-triggered automations that fired at unexpected times or without your physical presence at the tag location.

Context

NFC and QR tag-based automation is a popular feature for hands-free smart home control. This vulnerability highlights an important design assumption: tag links should be treated as proximity-sensitive actions, requiring validation that the delivery channel reflects genuine physical interaction. The fix in 2026.5.0 enforces this boundary at the OS routing layer.

Home Assistant is one of the most widely deployed self-hosted smart home platforms globally, with tens of millions of active installations.

References

  • NVD: CVE-2026-66061
  • Home Assistant iOS App — App Store
  • Home Assistant Community
#home-assistant#ios#nfc#cve-2026-66061#smart-home-security#mobile-security#bypass

Related Articles

CVE-2022-4995: Weaver E-cology 9.0 Unauthenticated File Upload Enables Webshell RCE

A critical unauthenticated file upload vulnerability in Weaver E-cology 9.0 allows attackers to upload JSP webshells through a vulnerable endpoint, achieving full remote code execution. The flaw has been actively exploited since at least October 2023.

4 min read

CVE-2026-19264: Critical Path Traversal in Postiz Exposes JWT Secrets and DB Credentials

A critical unauthenticated path traversal vulnerability in Postiz, the open-source social media scheduling platform, allows attackers to read arbitrary files including JWT secrets, database credentials, and API tokens — enabling full admin takeover.

4 min read

CVE-2026-50540: Kata Containers Host Code Execution via Unvalidated Config Path

A critical vulnerability in Kata Containers prior to 4.0.0 allows a pod user to load an arbitrary TOML file on the host through an unvalidated annotation, leading to root-level code execution and full container escape.

3 min read
Back to all Security Alerts