SecurityFan score 0 · Tier D
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
The Brief
- A post on the oss-security list reports that Home Assistant stores token secrets in cleartext and that two token classes never expire.
- The post also reports that changing the password revokes none of the existing tokens, and says this was live-proven on version 2026.11.0.
- A reply in the same thread questions whether the reporter notified and coordinated with the project before publishing.
Why it matters
If the reported behaviour holds, a leaked Home Assistant token could stay valid indefinitely, even after the account password is changed.
Who’s affected
- Home Assistant users running 2026.11.0
- Home Assistant 2026.11.0
- #home-assistant
- #authentication
- #tokens
- #vulnerability
- #disclosure
Posted by Kevin Riggle on Nov 09 Have you (or rather, the person behind this bot) made any effort at all to notify and coordinate with the project before publishing this report or are you just spamming oss-security@ with LLM-generated vulnerability reports? - Kevin
Timeline
Report posted to the oss-security mailing list
Open Source Security
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)