GoKawiilHome Assistant stores auth tokens in cleartext; password resets don't revoke them
A security report tested Home Assistant 2026.11.0 and found that refresh-token secrets and per-token JWT signing keys for every user are stored unencrypted in config/.storage/auth, unlike bcrypt-hashed passwords stored nearby. Long-lived and system refresh tokens never expire by default, and all four password-change methods (self-service, admin, Supervisor reset, command line) leave existing tokens valid. The researcher also found the automatic-backup password stored in plaintext and demonstrated live that a token copied before a password change still authenticated afterward.
GoKawiil's interpretation of the reporting above, not reported fact.
Home Assistant says it is installed in roughly two million homes controlling locks, alarms, cameras and garage doors, so unrevoked tokens could let an attacker who once obtained file access retain control indefinitely even after a victim changes their password. The report frames this as a gap between documented security advice — 'your password is the key to your home' — and the system's actual token lifecycle, suggesting users relying on password changes as a remediation step may be left exposed. Because backups bundle the same token store, restoring an old backup could reintroduce compromised credentials, which the researcher says compounds the risk.
- Refresh token secrets and signing keys are stored in cleartext, not hashed like passwords.
- Long-lived and system refresh tokens can be created with no expiration date.
- Changing a password does not revoke any existing tokens, leaving prior access valid.
YubiKey 5 NFC Security Key — If you self-host Home Assistant, pairing it with hardware-backed two-factor authentication like a YubiKey adds a real second layer beyond a password that this article shows isn't enough. It's a widely supported, physical key that works across logins and services, reducing reliance on tokens or credentials that could be exposed. Smart home security should start at the account layer, and hardware keys are a concrete step in that direction.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: seclists.org — Theknell--- Via Fulldisclosure, 2026-11-13
Published there as: “Home Assistant: the password is not the key – token secrets in cleartext”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.