Posted by theknell--- via Fulldisclosure on Nov 12 Home Assistant's documentation tells users: "Your password is the key to your home, so choose a strong, unique one." Home Assistant is installed in two million homes by the vendor's own published count, and in those homes it holds the locks, the alarm, the garage, the cameras, and the record of who is home. The password is not the key. Tested against home-assistant/core 2026.11.0 (frontend 20261028.4, hass-nabucasa 2.8.1):...
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
About this summary. This is a short excerpt from the description that Full Disclosure published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/fulldisclosure/2026/Nov/34
Source attribution: headline and facts are from Full Disclosure (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
n8n security advisory (AV26-1160)
Serial number: AV26-1160 Date: November 13, 2026 As of November 13, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 2.45.5 Prior to…
Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure
Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame.
Self-hosted Claude Managed Agents keeps agent credentials in your environment
Anthropic has released a self-hosted version of Claude Managed Agents. Companies can run the agent harness, sandboxes, credentials, and session history in their cloud or…
🏴☠️ N0n has just published a new victim : Female Daily Network
digital beauty community and commerce · Indonesia | Community member records of an Indonesian beauty platform: full names, email addresses, dates of birth, phone numbers…
Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT
Fortinet finds weak SQL Server passwords used to deliver a miner and Gh0st RAT
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.