Product
Home Assistant Core 2026.11.0 contains authentication and authorization flaws, including cleartext token storage, non-expiring token classes, and failure to revoke existing sessions upon password reset, facilitating unauthorized long-term access.