SecurityHacker Newsabout 1 hour ago
Home Assistant Exposes Token Secrets in Cleartext
2 min read
Security researcher theknell leaked proof that Home Assistant version 2026.11.0 stores token secrets in cleartext within config files. The flaw affects two million homes, allowing unauthorized access if the config directory is read. Changing passwords revokes none of the four token types, and long-lived tokens remain valid for ten years.
Level
Hype check
Tap to vote and see what everyone thinks.
