Home Assistant completes a sign-in protection for apps that request it: a captured authorization code cannot be exchanged without the secret held by the client that began the login. The browser login flow carries the client’s proof request through to Home Assistant’s authentication service.
Allen Porter also closes an alternate route that could accept a protected code for account linking without that proof. The protection, called PKCE, applies to clients using the new flow; existing sign-ins that do not request it keep their previous behavior.