Cross-site Scripting via auth_callback login in Home Assistant Core

CVE-2023-41895

What is CVE-2023-41895?

Home Assistant, an open source home automation platform, has a Cross-Site Scripting (XSS) vulnerability that arises when the login page allows users to log in using their local credentials on third-party websites. The vulnerability stems from insufficient validation of the redirect_uri parameter, particularly when javascript: scheme URIs are used. This leads to arbitrary JavaScript execution on the Home Assistant administration page, potentially allowing attackers to take over accounts and installations. The issue is resolved in version 2023.9.0, and users are strongly encouraged to upgrade to ensure their systems remain secure. No workarounds are available.

References