GoKawiilHome Assistant stores auth tokens in cleartext; password resets don't revoke them
A security report tested Home Assistant 2026.11.0 and found that refresh-token secrets and per-token JWT signing keys for every user are stored unencrypted in config/.storage/auth, unlike bcrypt-hashed passwords stored nearby. Long-lived and system refresh tokens never expire by default, and all four password-change methods (self-service, admin, Supervisor reset, command line) leave existing tokens valid. The researcher also found the automatic-backup password stored in plaintext and demonstrated live that a token copied before a password change still authenticated afterward.