Security · High impactFan score 0 · Tier D
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
The Brief
- Home Assistant 2026.11.0 stores token secrets in cleartext, according to the disclosure.
- Two token classes never expire, and changing the password revokes none of the existing tokens.
- The disclosure says the flaws were demonstrated live on 2026.11.0.
Why it matters
Tokens that never expire and survive a password change mean a leaked token could keep access to a Home Assistant instance indefinitely, even after the owner resets the password.
Who’s affected
- Home Assistant users on 2026.11.0
- Home Assistant 2026.11.0
- #home-assistant
- #security
- #authentication
- #tokens
- #smart-home
Posted by theknell on Nov 08 Home Assistant's documentation tells users: "Your password is the key to your home, so choose a strong, unique one." Home Assistant is installed in two million homes by the vendor's own published count, and in those homes it holds the locks…
Timeline
Flaws disclosed on the oss-sec mailing list by theknell
Open Source Security
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
Open Source Security publishes write-up on the flaws