RealFeedApp Two token classes never expire
Research revealed that token secrets and JWT signing keys for all users are stored in plaintext within config/.storage/auth, while passwords are bcrypt-hashed. This vulnerability exists in version 2026.11.0 and affects two million households.
- Field
- computer security
- What they did
- Researchers discovered that in the Home Assistant system, secret data for tokens (keys for access) is stored in plain text in a file, while user passwords are hashed. This means a malicious actor can gain access to a user's functionality simply by reading this file without knowing their password.
- Why it matters
- This creates a critical security vulnerability for millions of households using the system, as token protection does not match the claimed level of password protection.
#home assistant#security#token#plaintext#hass
