CVE-2025-25305

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-940

• https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6

Published

Feb 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2530Luxion KeyShot DAE File Parsing Access of Uninitialized Poin…7.8
• CVE-2025-25300smartbanner.js is a customizable smart app banner for iOS an…1.3
• CVE-2025-25301Rembg is a tool to remove images background. In Rembg 2.0.57…7.5
• CVE-2025-25302Rembg is a tool to remove images background. In Rembg 2.0.57…6.5
• CVE-2025-25303The MouseTooltipTranslator Chrome extension allows mouseover…6.9
• CVE-2025-25304Vega is a visualization grammar, a declarative format for cr…6.9
• CVE-2025-25306Misskey is an open source, federated social media platform. …9.3
• CVE-2025-2531Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow R…7.8
• CVE-2025-2532Luxion KeyShot USDC File Parsing Use-After-Free Remote Code …7.8
• CVE-2025-25323An issue in Qianjin Network Information Technology (Shanghai…5.5
• CVE-2025-25324An issue in Shandong Provincial Big Data Center AiShanDong i…5.5
• CVE-2025-25325An issue in Yibin Fengguan Network Technology Co., Ltd YuPao…5.5