Vulnerability · high
Home Assistant token secrets and token expiry flaws in 2026.11.0
Tier D · Background noise – Good to know
Who’s exposed: Home Assistant installs in about two million homes
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
The Brief
- Home Assistant 2026.11.0 stores token secrets in cleartext, according to the disclosure.
- Two token classes never expire, and changing the password revokes none of the existing tokens.
- The disclosure says the flaws were demonstrated live on 2026.11.0.
Why it matters
Tokens that never expire and survive a password change mean a leaked token could keep access to a Home Assistant instance indefinitely, even after the owner resets the password.
The checklist behind the tier
Checklist · 0 of 10 yes
| No | Hits tech teams | Judgment: Home Assistant is a self-hosted smart-home platform run mainly by hobbyists, not a developer or ops tool. |
| No | Core infrastructure | Judgment: a single home-automation application, not software nearly every engineering team runs. |
| No | Popular tool | Judgment: popular in smart-home circles, but not mainstream developer tech used across many teams. |
| No | Exploited in the wild | Open Source Security: described as 'live-proven' by a researcher; no source reports observed attacks. |
| No | Public exploit | Open Source Security: post describes flaws; no source says exploit code or a PoC was published. |
| No | Remote, no login | Open Source Security: sources do not state that unauthenticated network access is enough. |
| No | Full takeover | Open Source Security: sources do not state code execution, admin rights or account takeover. |
| No | Secrets exposed | Open Source Security: cleartext token secrets described, but only researcher demonstration; no reported theft or breach. |
| No | Supply chain | Open Source Security: flaws concern token handling; no compromised package, update or pipeline reported. |
| No | No fix yet | Open Source Security: sources do not say whether a patched version exists. |
Timeline
Flaws disclosed on the oss-sec mailing list by theknell
Open Source Security
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
Open Source Security publishes write-up on the flaws
Source
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven) ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided