Dashboard / CVE-2026-54317

CVE-2026-54317

HIGH
MEDIUM Priority: 0.02 BB Relevance: 60/100
Published: 2026-06-23 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: Low
A: Low

Description

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configuration." That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request's Authorization: Bearer <token> header against the integration's stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
home-assistant home-assistant < 2026.6.0

References & Advisories (1)

Bug Bounty Relevance

60 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.6 / 10.0 v3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS — Exploitation Probability

0.31%
Raw Score 0.003080
Percentile 23.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00308
2026-10-28
0.00308

Intelligence Sources

nvd ref →

External Links