CVE-2023-41894

Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-669

• https://github.com/home-assistant/core/security/advisories/GHSA-wx3j-3v2j-rf45Vendor Advisory
• https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/Vendor Advisory
• https://github.com/home-assistant/core/security/advisories/GHSA-wx3j-3v2j-rf45Vendor Advisory
• https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/Vendor Advisory

Published

Oct 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41889SHIRASAGI is a Content Management System. Prior to version 1…5.3
• CVE-2023-4189Cross-site Scripting (XSS) - Reflected in GitHub repository …4.8
• CVE-2023-41890Sustainsys.Saml2 library adds SAML2P support to ASP.NET web …7.5
• CVE-2023-41891FlyteAdmin is the control plane for Flyte responsible for ma…8.8
• CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
• CVE-2023-41893Home assistant is an open source home automation. The audit …5.4
• CVE-2023-41895Home assistant is an open source home automation. The Home A…9.6
• CVE-2023-41896Home assistant is an open source home automation. Whilst aud…9
• CVE-2023-41897Home assistant is an open source home automation. Home Assis…9.6
• CVE-2023-41898Home assistant is an open source home automation. The Home A…7.8
• CVE-2023-41899Home assistant is an open source home automation. In affecte…7.2
• CVE-2023-4190Insufficient Session Expiration in GitHub repository admidio…6.5