{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/home-assistant-core-2026.11.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Home Assistant Core (2026.11.0)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Home Assistant"],"content_html":"\u003cp\u003eHome Assistant Core 2026.11.0 exhibits critical security deficiencies regarding authentication lifecycle management. The vendor documentation emphasizes the strength of passwords; however, technical analysis confirms that the internal implementation fails to treat the password as a primary security boundary. Specifically, token secrets are stored in cleartext, certain token classes do not implement expiration logic, and password change events do not trigger the revocation of active sessions or tokens. These issues allow an attacker who has compromised a token to maintain persistent access even after the user changes their account password.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for long-term unauthorized access to the Home Assistant instance, potentially granting control over integrated smart home hardware, including locks, alarm systems, garage doors, and surveillance cameras, as well as access to presence history.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor Home Assistant release notes for security patches addressing session management and token storage.\u003c/li\u003e\n\u003cli\u003eAudit active long-lived access tokens and sessions within the Home Assistant interface for unauthorized or stale entries.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions to limit exposure of the Home Assistant interface to untrusted networks until updates are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T01:11:02Z","date_published":"2026-11-09T01:11:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-home-assistant-auth/","summary":"Home Assistant Core 2026.11.0 contains authentication and authorization flaws, including cleartext token storage, non-expiring token classes, and failure to revoke existing sessions upon password reset, facilitating unauthorized long-term access.","title":"Home Assistant Core: Authentication and session management vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-11-home-assistant-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Home Assistant Core (2026.11.0)","version":"https://jsonfeed.org/version/1.1"}