# Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/578) · 2026-11-08 · Security
Page: https://themorning.dev/story/home-assistant-the-password-is-not-the-key-token-secrets-in-cleartext-two-token-30d23946b67fadd1
Kind: security · Impact: high

## In brief

- Home Assistant 2026.11.0 stores token secrets in cleartext, according to the disclosure.
- Two token classes never expire, and changing the password revokes none of the existing tokens.
- The disclosure says the flaws were demonstrated live on 2026.11.0.

## Why it matters

Tokens that never expire and survive a password change mean a leaked token could keep access to a Home Assistant instance indefinitely, even after the owner resets the password.

## Versions

- Home Assistant 2026.11.0

## Timeline

- 2026-11-08: Flaws disclosed on the oss-sec mailing list by theknell
- 2026-11-09: Open Source Security publishes write-up on the flaws

## Coverage

- [Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)](https://seclists.org/oss-sec/2026/q4/578) — Open Source Security, 2026-11-08

Tags: home-assistant, security, authentication, tokens, smart-home

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev