{"action":"Upgrade homeassistant to 2023.9.0 or later.","affected":[{"fixed":"2023.9.0","introduced":"0"}],"component":"homeassistant","cve_ids":["CVE-2023-41893"],"ecosystem":"PyPI","epss":0.00452,"exploited":false,"fixed_versions":["2023.9.0"],"ghsa_id":"GHSA-qhhj-7hrc-gqj5","id":"tcs_01M5KFW5TT92GDMH5PA9K32ATK","modified_at":"2026-09-10T03:50:03.983248027Z","published_at":"2023-10-26T21:46:22Z","references":["https://osv.dev/vulnerability/GHSA-qhhj-7hrc-gqj5","https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5","https://nvd.nist.gov/vuln/detail/CVE-2023-41893","https://github.com/home-assistant/core","https://github.com/pypa/advisory-database/tree/main/vulns/homeassistant/PYSEC-2023-214.yaml","https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-qhhj-7hrc-gqj5","url":"https://osv.dev/vulnerability/GHSA-qhhj-7hrc-gqj5"}],"summary":"Home Assistant vulnerable to account takeover via auth_callback login"}