CVE-2023-41895

Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` validation typically ensures that it matches the `client_id` and the scheme represents either `http` or `https`, Home Assistant will fetch the `client_id` and check for `<link rel="redirect_uri" href="...">` HTML tags on the page. These URLs are not subjected to the same scheme validation and thus allow for arbitrary JavaScript execution on the Home Assistant administration page via usage of `javascript:` scheme URIs. This Cross-site Scripting (XSS) vulnerability can be executed on the Home Assistant frontend domain, which may be used for a full takeover of the Home Assistant account and installation. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://github.com/home-assistant/core/security/advisories/GHSA-jvxq-x42r-f7mvVendor Advisory
• https://github.com/home-assistant/core/security/advisories/GHSA-jvxq-x42r-f7mvVendor Advisory

Published

Oct 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4189Cross-site Scripting (XSS) - Reflected in GitHub repository …4.8
• CVE-2023-41890Sustainsys.Saml2 library adds SAML2P support to ASP.NET web …7.5
• CVE-2023-41891FlyteAdmin is the control plane for Flyte responsible for ma…8.8
• CVE-2023-41892Craft CMS is a platform for creating digital experiences. Th…9.8
• CVE-2023-41893Home assistant is an open source home automation. The audit …5.4
• CVE-2023-41894Home assistant is an open source home automation. The assess…5.3
• CVE-2023-41896Home assistant is an open source home automation. Whilst aud…9
• CVE-2023-41897Home assistant is an open source home automation. Home Assis…9.6
• CVE-2023-41898Home assistant is an open source home automation. The Home A…7.8
• CVE-2023-41899Home assistant is an open source home automation. In affecte…7.2
• CVE-2023-4190Insufficient Session Expiration in GitHub repository admidio…6.5
• CVE-2023-41900Jetty is a Java based web server and servlet engine. Version…4.3