An authorization bypass exists in Hubitat Elevation firmware versions prior to 2.4.2.157. Once authenticated to the hub, a user can modify a key in client‑side requests that the hub trusts, leading the controller to execute device commands that fall outside the user’s allowed device scope. The result is that an attacker can remotely control devices they should not be able to, compromising the integrity and availability of the home automation system.

The flaw applies to all Hubitat Elevation models, including Elevation C3, C4, C5, C7, C8, and the elevated C8 Pro, when running firmware earlier than 2.4.2.157.

The CVSS score of 9.4 places this vulnerability in the critical range. The EPSS score of <1% indicates a very low probability of exploitation, but the ability to bypass authorization makes it highly valuable to an attacker. The flaw is not currently listed in the CISA KEV catalog. Attackers simply need already authenticated access to the hub’s interface or API and can manipulate request parameters to instruct the hub to control devices outside their legitimate permissions.