# Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/603) · 2026-11-09 · Security
Page: https://themorning.dev/story/re-home-assistant-the-password-is-not-the-key-token-secrets-in-cleartext-two-tok-9e08f98ecdcb692b
Kind: security · Impact: medium

## In brief

- A post on the oss-security list reports that Home Assistant stores token secrets in cleartext and that two token classes never expire.
- The post also reports that changing the password revokes none of the existing tokens, and says this was live-proven on version 2026.11.0.
- A reply in the same thread questions whether the reporter notified and coordinated with the project before publishing.

## Why it matters

If the reported behaviour holds, a leaked Home Assistant token could stay valid indefinitely, even after the account password is changed.

## Versions

- Home Assistant 2026.11.0

## Timeline

- 2026-11-09: Report posted to the oss-security mailing list

## What developers say

Only one reply was provided, and it is sceptical of the report. The commenter asks whether the reporter contacted the project before publishing and suggests the report is LLM-generated spam. The comment does not address the technical claims. (sentiment: negative)

> are you just spamming oss-security@ with LLM-generated vulnerability reports? — Kevin Riggle, Open Source Security

## Coverage

- [Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)](https://seclists.org/oss-sec/2026/q4/603) — Open Source Security, 2026-11-09

Tags: home-assistant, authentication, tokens, vulnerability, disclosure

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev