Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users).
Related posts