CVE-2023-27482: Home Assistant Supervisor authentication bypass via API

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication, scope change and very high EPSS make this an urgent patch-or-isolate case.

What it is

Home Assistant Supervisor 2023.01.1 and older contains an improper authentication flaw (CWE-287) that lets a remote attacker bypass authentication and reach the Supervisor API through Home Assistant. Because the Supervisor controls the host and add-ons, bypassing its authentication is a full compromise of the installation, and the flaw affects all installation types that use the Supervisor.

Impact

An unauthenticated remote attacker gains access to the Supervisor API, which can lead to full control of the Home Assistant host and its managed components, consistent with the CVSS scope change and high confidentiality, integrity and availability ratings.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), meaning any internet-exposed Home Assistant instance using the affected Supervisor can be targeted directly. Container and manual Core installations are not affected.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.71974, 99.4th percentile), and public writeups and advisories exist, indicating meaningful real-world exploitation risk.

What to do

• Upgrade Home Assistant Supervisor to 2023.03.1 or later (auto-update already rolled this out to affected installations).
• Upgrade Home Assistant Core to at least 2023.3.0, which includes mitigation.
• If upgrading is not possible, remove internet exposure of the Home Assistant instance immediately.
• Verify the Supervisor version on every installation and confirm auto-update completed.
• Restrict network access to the Supervisor API to trusted management networks only.

Detection

• Audit Supervisor and Core version strings across all Home Assistant instances to find those below 2023.03.1 / 2023.3.0.
• Review Supervisor API and Home Assistant access logs for unauthenticated or anomalous requests, especially from external IPs.
• Monitor for unexpected add-on installs, configuration changes or host-level commands issued through the Supervisor API.
• Alert on new or unusual inbound connections to Home Assistant/Supervisor ports from the internet.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.