AIKIDO-2026-10312

TL;DR

Affected versions of this package are vulnerable to a server-side request forgery (SSRF) bypass due to insufficient validation of HTTP redirects in the internal HTTP client. When Home Assistant performs outbound HTTP requests, a malicious server could return a redirect pointing to localhost or other loopback addresses, causing the client to follow the redirect and access internal services that should not be reachable. An attacker controlling the remote endpoint could exploit this behavior to force requests to internal network resources, potentially exposing sensitive services or data. The issue is addressed by blocking redirects that resolve to loopback or unspecified addresses such as localhost.