Authentication Bypass in Home Assistant's Konnected Integration

CVE-2026-54317

What is CVE-2026-54317?

The Konnected integration in Home Assistant, an open-source home automation software, previously allowed unauthorized access to sensitive functions due to a lack of proper authentication checks for GET requests. While write requests (POST and PUT) validate against an access token, the read requests (GET) were exposed, letting attackers potentially access crucial data. This issue has been resolved in the 2026.6.0 update, emphasizing the importance of robust security measures in IoT devices.

References