https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:32:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-54317 <p><strong>Affected:</strong> home-assistant core</p> <p>Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled &#34;via the access token from configuration.&#34; That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request&#39;s Authorization: Bearer &lt;token&gt; header against the integration&#39;s stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.</p> <p><strong>Affected:</strong> home-assistant core</p> <p>Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled &#34;via the access token from configuration.&#34; That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request&#39;s Authorization: Bearer &lt;token&gt; header against the integration&#39;s stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-54317