Home Assistant Core (2026.11.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/home-assistant-core-2026.11.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 01:11:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHome Assistant Core: Authentication and session management vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-11-home-assistant-auth/Mon, 09 Nov 2026 01:11:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-home-assistant-auth/Home Assistant Core 2026.11.0 contains authentication and authorization flaws, including cleartext token storage, non-expiring token classes, and failure to revoke existing sessions upon password reset, facilitating unauthorized long-term access.Home Assistant Core 2026.11.0 exhibits critical security deficiencies regarding authentication lifecycle management. The vendor documentation emphasizes the strength of passwords; however, technical analysis confirms that the internal implementation fails to treat the password as a primary security boundary. Specifically, token secrets are stored in cleartext, certain token classes do not implement expiration logic, and password change events do not trigger the revocation of active sessions or tokens. These issues allow an attacker who has compromised a token to maintain persistent access even after the user changes their account password.

Impact

Successful exploitation allows for long-term unauthorized access to the Home Assistant instance, potentially granting control over integrated smart home hardware, including locks, alarm systems, garage doors, and surveillance cameras, as well as access to presence history.

Recommendation

  • Monitor Home Assistant release notes for security patches addressing session management and token storage.
  • Audit active long-lived access tokens and sessions within the Home Assistant interface for unauthorized or stale entries.
  • Implement network-level restrictions to limit exposure of the Home Assistant interface to untrusted networks until updates are applied.
]]>mediumadvisory