PT-2026-51577 · Home Assistant · Core

Waihankan · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-54318

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.5.3

Description The LocationSensorManager BroadcastReceiver is exported without requiring permissions. This allows any installed application on the device, regardless of its runtime permissions, to send a forged Google Play Services LocationResult to the receiver. The receiver trusts this data and forwards it to the Home Assistant server as the actual device location. This process bypasses the Android developer-mode Mock Location gate, enabling a malicious local application to trigger zone-based automations, such as unlocking doors, disarming alarms, or opening garages, by spoofing the GPS position.

Recommendations Update to version 2026.5.3.

Fix

Weakness Enumeration

CWE-926

Related Identifiers

CVE-2026-54318

Affected Products

Core

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54318 · Security Note
• https://github.com/home-assistant/core/security/advisories/GHSA-77r5-pw5w-mgj3 · Note
• https://github.com/home-assistant/android/pull/6837 · Note
• https://twitter.com/VulmonFeeds/status/2069504881702887751 · Twitter Post