The Home Assistant Android Companion app hid a flaw that allowed attackers to craft a deep link using the homeassistant://invite scheme which redirected a legitimate invite into a malicious login page. When a victim tapped the normal "Connect to my Home Assistant server" button, the application silently steered the WebView to the attacker's /auth/authorize endpoint without ever displaying the true destination. Because the onboarding flow never shows the parsed server URL, users have no way to discern a legitimate request from a spoofed one. This open redirect flaw is consistent with CWE‑601 and can be leveraged for credential phishing.

The vulnerability exists in the Home Assistant Android Companion app versions prior to 2026.6.1. Any device running an older version of the companion app remains vulnerable, regardless of the underlying Home Assistant core version, as the flaw resides entirely in the mobile client.

Security risk is moderate: the CVSS score of 4.3 indicates a low–to‑moderate impact, and the absence of a public exploit reduces immediate threat. However, KEV status is not listed, and EPSS data is unavailable, implying a low to unknown exploitation probability. The likely attack vector is social‑engineering through invitation links sent to new users, who are especially unlikely to notice the substitution. In the absence of a public workaround, updating to the fixed release is the only reliable countermeasure.