Security researchers discovered that unhashed configuration files in the smart home platform expose token secrets and signing keys to anyone with file-read access. This architectural flaw directly endangers roughly two million households by compromising physical controls such as alarms, garages, and door locks. Because standard credential resets fail to revoke these credentials, unauthorized access can persist indefinitely once files are exposed. Furthermore, automated backups compound the threat by bundling these sensitive token files alongside plaintext backup passwords.
Key points
Attackers with read access to configuration directories or backup archives can establish…: Attackers with read access to configuration directories or backup archives can establish persistent access that bypasses password changes.
The security flaw leaves physical access systems such as locks and cameras vulnerable acr…: The security flaw leaves physical access systems such as locks and cameras vulnerable across two million deployed homes.
Restoring settings archives revives historical tokens from the backup date, undoing prior…: Restoring settings archives revives historical tokens from the backup date, undoing prior security remediations.
Sources checked by our analysis pipeline: 1
Full Disclosure mailing list archives
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
From: theknell--- via Fulldisclosure <fulldisclosure () seclists org>
Date: Sun, 08 Nov 2026 11:02:24 -0500
Home Assistant's documentation tells users: "Your password is the key to your home, so choose a strong, unique one." Home Assistant is installed in two million homes by the vendor's own published count, and in those homes it holds the locks, the alarm, the garage, the cameras, and the record of who is home. The password is not the key. Tested against home-assistant/core 2026.11.0 (frontend 20261028.4, hass-nabucasa 2.8.1): 1. Every refresh token's secret and its per-token JWT signing key, for every user, is serialized in cleartext in one file: config/.storage/auth. Passwords in the neighbouring store are bcrypt-hashed; token secrets are not hashed at all — validation is a direct string comparison against the stored value. 2. Two of the three token classes never expire. Long-lived and system refresh tokens are created with expire_at = None; the…
The revamped e-reader portfolio introduces color E-Ink technology aimed at users reading comics, graphic novels, and cookbooks. While the hardware offers functional enhancements like multi-colored highlighting and a lighter chassis, its substantial cost positions it well above standard e-reading alternatives. Budget-conscious consumers may find the updated monochrome devices provide significantly better overall value.
Operational disruptions have struck meteorological systems across the United States following widespread technical failures. The agency confirmed that its digital connectivity and external contact channels are currently compromised across the country. Further details regarding the root cause or operational impacts remain limited under the initial assessment.
Federal authorities examining the recent system failure are directing their scrutiny toward internal technical operations rather than outside interference. Investigators are actively assessing how routine maintenance may have disrupted the agency's infrastructure during the event. This line of inquiry indicates that operational errors remain the central concern behind the widespread service disruption.