Home Assistant’s Companion app previously treated NFC or QR tag links received from an OS‑level routing service as if a user had physically scanned them, without confirming the calling application or requesting user confirmation. As a result, any local app on the device could forge a tag and trigger an automation in Home Assistant that normally would require a legitimate user action, allowing silent, unattended automation execution. The weakness is a lack of proper caller identification, which corresponds to the CWE classification of unauthorized access to privileged resources.

The flaw affects Home Assistant core implementations running versions prior to 2026.8.1, specifically those released before the 2026.5.3 release. These include any installations where the Companion app can receive NFC or QR data on Android devices, regardless of whether the organization has a high‑security perimeter or local network isolation.

The CVSS score of 7.1 indicates a high severity, and while the EPSS score is not available, the fact that the flaw can be exploited by any untrusted local application without user interaction raises the likelihood that it will be abused. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but its local nature and silent execution make it attractive for attackers who can gain privileged control over Home Assistant actions. The attack vector is inferred as local software on the same device: an attacker installs or modifies an app to send crafted NFC/QR data, which Home Assistant accepts and executes the associated automation. No network or remote exploitation is required.