CVE-2023-41893

Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim’s `access_token` the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions. To achieve this compromise attempt, the attacker must send a link with a `redirect_uri` that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via said link, the attacker would obtain code sent to the specified URL in `redirect_uri`, which can then be leveraged to fetch an `access_token`. Pertinently, an attacker could increase the efficacy of this strategy by registering a near identical domain to `homeassistant.local`, which at first glance may appear legitimate and thereby obfuscate any malicious intentions. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-200

• https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5Vendor Advisory
• https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/Vendor Advisory
• https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5Vendor Advisory
• https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/Vendor Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41888GLPI stands for Gestionnaire Libre de Parc Informatique is a…5.4
• CVE-2023-41889SHIRASAGI is a Content Management System. Prior to version 1…5.3
• CVE-2023-4189Cross-site Scripting (XSS) - Reflected in GitHub repository …4.8
• CVE-2023-41890Sustainsys.Saml2 library adds SAML2P support to ASP.NET web …7.5
• CVE-2023-41891FlyteAdmin is the control plane for Flyte responsible for ma…8.8
• CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
• CVE-2023-41894Home assistant is an open source home automation. The assess…5.3
• CVE-2023-41895Home assistant is an open source home automation. The Home A…9.6
• CVE-2023-41896Home assistant is an open source home automation. Whilst aud…9
• CVE-2023-41897Home assistant is an open source home automation. Home Assis…9.6
• CVE-2023-41898Home assistant is an open source home automation. The Home A…7.8
• CVE-2023-41899Home assistant is an open source home automation. In affecte…7.2