Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
Summary
Security research published in Full Disclosure (Nov 2026) uncovers token/secrets management flaws in Home Assistant: refresh tokens and per-token signing keys are stored in cleartext in config/.storage/auth, token secrets are not hashed, and two token classes never expire. Password changes do not revoke existing tokens, and backups contain plaintext token data, enabling token resurrection. The issue highlights risks from local config/file disclosures rather than remote network breaches.