Home Assistant Core: Authentication and session management vulnerabilities

Home Assistant Core 2026.11.0 exhibits critical security deficiencies regarding authentication lifecycle management. The vendor documentation emphasizes the strength of passwords; however, technical analysis confirms that the internal implementation fails to treat the password as a primary security boundary. Specifically, token secrets are stored in cleartext, certain token classes do not implement expiration logic, and password change events do not trigger the revocation of active sessions or tokens. These issues allow an attacker who has compromised a token to maintain persistent access even after the user changes their account password.

Impact

Successful exploitation allows for long-term unauthorized access to the Home Assistant instance, potentially granting control over integrated smart home hardware, including locks, alarm systems, garage doors, and surveillance cameras, as well as access to presence history.

Recommendation

• Monitor Home Assistant release notes for security patches addressing session management and token storage.
• Audit active long-lived access tokens and sessions within the Home Assistant interface for unauthorized or stale entries.
• Implement network-level restrictions to limit exposure of the Home Assistant interface to untrusted networks until updates are applied.