ha-mcp vulnerabilities (PyPI)
4 vulnerabilities.
-
ha-mcpPyPI ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path 6.5 Medium -
ha-mcpPyPI Home Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/ 6.5 Medium -
ha-mcpPyPI ha-mcp has XSS via Unescaped HTML in OAuth Consent Form 6.8 Medium -
ha-mcpPyPI ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle 5.3 Medium