Home Assistant closes a way for an authenticated user to pose as someone else inside apps that trust Supervisor’s sign-in information. Requests could supply differently capitalized identity headers that escaped the proxy’s filter and reached the app beside the genuine identity.
Supervisor checks those header names without regard to capitalization and supplies its own values after filtering. The protection covers both ordinary requests and live WebSocket connections; the reported impersonation risk concerns apps using these headers for single sign-on.