The iOS Companion App for Home Assistant disregards the internal SSID allowlist when determining whether to use an internal URL. If the app cannot find another URL, it automatically falls back to the internal URL, potentially transmitting the user's access token and sensor data over an unsecured network. This flaw limits confidentiality and could expose sensitive information. The weakness is classified as CWE‑319, an insecure fallback that leaks credentials.

The vulnerability affects Home Assistant core versions prior to 2025.5.0 on any platform that uses the iOS Companion App. Any user running an older Home Assistant Core installation with the companion app could be impacted.

The CVSS score of 7.5 indicates a high level of overall risk, though the EPSS score is not provided. The flaw is not listed in the CISA KEV catalog. Exploitation requires the device to be connected to a non‑secure network; an attacker within range could trigger the fallback and capture the transmitted token, leading to unauthorized access to the Home Assistant instance and its sensor data. Because the flaw is triggered by network conditions rather than a sophisticated attack, it may be relatively easy for an attacker in the same local network to abuse it.