Home Assistant token and password weaknesses reported

Tier D · Background noise – Good to know

Who’s exposed: Home Assistant installations on version 2026.11.0

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

The Brief

A post on the oss-security list reports that Home Assistant stores token secrets in cleartext and that two token classes never expire.
The post also reports that changing the password revokes none of the existing tokens, and says this was live-proven on version 2026.11.0.
A reply in the same thread questions whether the reporter notified and coordinated with the project before publishing.

If the reported behaviour holds, a leaked Home Assistant token could stay valid indefinitely, even after the account password is changed.

Checklist · 0 of 10 yes

No	Hits tech teams	Judgment: Home Assistant is a consumer smart-home platform, not software developers or ops teams run.
No	Core infrastructure	Judgment: a single smart-home application, not software nearly every team runs.
No	Popular tool	Judgment: popular in hobbyist smart-home circles, but not mainstream developer tech used by many teams.
No	Exploited in the wild	Open Source Security post reports a live-proven weakness, but no source reports observed attacks.
No	Public exploit	Open Source Security post describes the flaws; no source says exploit code or a PoC is published.
No	Remote, no login	Open Source Security post does not say the flaws are reachable without credentials.
No	Full takeover	Open Source Security post does not report code execution, admin takeover or account takeover.
No	Secrets exposed	Open Source Security post says token secrets are stored in cleartext; no source reports they were stolen.
No	Supply chain	Open Source Security post reports token and password weaknesses; no source reports malicious code shipped.
No	No fix yet	Open Source Security post does not state whether a patched version exists or is missing.

First seen 2h ago · 1 source · Full story page · How tiers are decided