CVE-2026-59717

CVE-2026-59717 affects the Android companion for Home Assistant prior to 2026.6.1. The issue is an open redirect in the homeassistant://invite flow where the URL fragment is passed into the onboarding WebView without displaying the destination hostname. As a result, a victim cannot distinguish a ...