Home Assistant's 'key to your home' is actually a sticky note on the fridge

Security researchers have uncovered serious flaws in Home Assistant's authentication system, exposing 'keys' to two million smart homes. The popular home automation platform stores all user refresh token secrets completely unencrypted in plaintext within a configuration file, making them as vulnerable as a password written on a post-it note. Even more alarmingly, two types of tokens never expire—some are valid for ten years—and changing your password does absolutely nothing to revoke any of these tokens, leaving compromised access permanently intact.

The real-world impact is terrifying for anyone trusting this software with their locks, cameras, and alarms. If an attacker gains even temporary read access to the configuration directory (through a misconfigured backup, support request, or any file disclosure), they gain durable, password-change-resistant control over the entire smart home ecosystem. The platform's own documentation misleadingly claims "your password is the key to your home," while the actual security model treats that key like a public library book—easily copied and impossible to change. Home automation shouldn't mean automating your own home invasion.