CVE-2023-41894

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-418959.6Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials a CVE-2023-418969.0Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_cal CVE-2023-418979.6Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Option CVE-2023-418987.8Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbit CVE-2023-418997.2Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Reque CVE-2023-41906.5Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.CVE-2023-419004.3Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authenticat CVE-2023-419027.8An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by CVE-2023-419045.4Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.CVE-2023-419055.4NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user.CVE-2023-419085.3Cerebrate before 1.15 lacks the Secure attribute for the session cookie.CVE-2023-419097.5An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no at