SecLists · Full Disclosure·· 5 小时前推荐指数67
Home Assistant 被披露令牌密钥明文存储且改密码不吊销漏洞
Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
AI 导读
研究者 theknell 在 Full Disclosure 披露 Home Assistant 2026.11.0 的令牌安全问题：所有 refresh token 的密钥与 JWT 签名密钥以明文存于 config/.storage/auth。
来源：SecLists · Full Disclosure · seclists.org