CVE-2023-27482 Auth bypass in core
Attackers can bypass authentication to access the Supervisor API in Home Assistant installations using affected Supervisor versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27482?
CVE-2023-27482 is a critical authentication bypass vulnerability in home-assistant core, published on 8 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
Weakness: CWE-287
Which versions are affected by CVE-2023-27482?
It affects 2 products.
Products include Home-Assistant Home-Assistant, Home-Assistant Supervisor.
How do I fix CVE-2023-27482?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-27482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27482 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in home-assistant core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
- CVE-2018-21019 Home Assistant information disclosure vulnerability
Sources
Also known as GHSA-2j8f-h4mr-qr25, ROOT-OS-ALPINE-319-CVE-2023-27482.