Home Assistant token secrets in cleartext
Token secrets remain unexpired after password changes and are stored in cleartext.
Stories per day · 30 days
2 RSS
Relatedpwn2own2zdi2aiohttp1cleartext1cleartext-credentials1github1privilege-escalation1secrets1ssrf1tokens1unverified1
7 stories, newest first · one card per story
Stories tagged #home-assistant
Home Assistant Green stores credentials in cleartext, enabling local privilege escalation
Attackers need low-privileged code in a container first; ZDI rates CVE-2026-91131 at CVSS 8.8.
Pwn2Own Ireland 2026 - Day Two Results
Pwn2Own Ireland 2026 day two lists 24 attempts after $388,500 was awarded for 32 zero-days.
ZDI-26-563: (Pwn2Own) Home Assistant Green Simple Service Discovery Protocol Server-Side Request Forgery Vulnerability
ZDI disclosed a Pwn2Own SSRF flaw (CVSS 5.4) in Home Assistant Green's SSDP server, letting unauthenticated network-adjacent attackers trigger arbitrary server-side requests.
ZDI-26-562: (Pwn2Own) Home Assistant Green mDNS Server-Side Request Forgery Vulnerability
ZDI-26-562 details an unauthenticated, network-adjacent SSRF in the Home Assistant Green mDNS server, rated CVSS 5.4 and originally demonstrated at Pwn2Own.
ZDI-26-560: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability
ZDI disclosed another Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent code execution after obtaining localhost access.
ZDI-26-561: (Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability
ZDI disclosed a Pwn2Own command injection flaw (CVSS 7.5) in Home Assistant Green's go2rtc, enabling network-adjacent attackers to execute arbitrary code via localhost access.