Authentication Bypass

homeassistant is vulnerable to Authentication Bypass. The vulnerability is caused by an attacker triggering a webhook that are marked as only accessible from the local network, even when the attacker is not connected to the local network. The attacker could exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable Home Assistant instance. The request would cause the Home Assistant instance to trigger the webhook, even if the webhook is marked as only accessible from the local network which could allow the attacker to execute arbitrary code on the Home Assistant instance or steal data from the user’s local network.