Authentication bypass: PIN validation fails to reject incorrect PINs #1859

New Issue

MrUnknownDE · 2026-04-05T19:42:49+02:00

MrUnknownDE commented

2026-04-05 19:42:49 +02:00

Originally created by @mallendeo on 1/18/2025

I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not.

This does not happen when using only the password method though.

Enabling PIN makes it insecure.

*Originally created by @mallendeo on 1/18/2025* I assigned an access PIN to my HomeAssistant instance, but when entering any PIN code, the system grants access regardless of whether the PIN is correct or not. This does not happen when using only the password method though. <img width="568" alt="Image" src="https://github.com/user-attachments/assets/1ece650c-fd55-4b15-8542-09b7da5adb55" /> Enabling PIN makes it insecure.

MrUnknownDE closed this issue

2026-04-05 19:42:49 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1859