news
Full Disclosure
November 13th, 2026 at 1:45 AM

Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)

Posted by theknell--- via Fulldisclosure on Nov 12 Home Assistant's documentation tells users: "Your password is the key to your home, so choose a strong, unique one." Home Assistant is installed in two million homes by the vendor's own published count, and in those homes it holds the locks, the alarm, the garage, the cameras, and the record of who is home. The password is not the key. Tested against home-assistant/core 2026.11.0 (frontend 20261028.4, hass-nabucasa 2.8.1):...

#ai

Get stories like this every Monday

The week's most important AI news in one email. Free, unsubscribe anytime.

Score: 2.84

Engagement proxy: 0

Canonical link: https://seclists.org/fulldisclosure/2026/Nov/34