Two small changes to Home Assistant's login code close timing gaps that let a burst of simultaneous requests get more tries than the limits allow. Both come from GitHub user zweckj, and Franck Nijhof (frenck) merged both into the development branch on 19 October 2026 at 09:33 Polish time. They are labelled as bug fixes, not security advisories, and no CVE has been assigned. Both are in line for Home Assistant 2026.11, due in early November.
A ban that came seconds too late
When a login fails, Home Assistant counts the failure and bans the source address once it reaches the configured limit. Until now it first ran a reverse DNS lookup on the address, to put a host name in the log and in the notification, and only then increased the counter. That lookup can take seconds. In the meantime, further requests from the same address still got through, even after the failure that should have triggered the ban.
Pull request #187215 swaps the order. The failure is counted, and the address banned if it hits the limit, before the lookup. The ban is registered in memory before it is written to the file, so the very next request is rejected. Log messages and notifications look the same as before. The change covers every path that reports a failed login: the ban middleware, invalid authentication on API requests, the login flow and WebSocket authentication.
Two requests in one login flow
Pull request #187171 deals with the login flow itself. The endpoint POST /auth/login_flow/{flow_id} used to let several requests advance the same flow at once. Each request ran the full step on the same object, the password or MFA code check ran in a worker thread, and the flow's state, including its count of wrong attempts, was updated by whichever request finished first. That count matters: the flow aborts after too many wrong codes, five for the TOTP authenticator app module.
Now a request for a flow that is already handling another one gets 409 Conflict. The flow can continue as soon as the first request finishes, even if it ended with an error. The Home Assistant frontend sends one request at a time, so normal logins are not affected.
Is your instance banning anyone?
IP banning is switched on in the code by default, but the attempt limit defaults to unlimited, so Home Assistant only bans an address once you set a number. The setting is under Settings > System > Network, in the HTTP server section: turn off Unlimited login attempts and set Login attempts before ban to a value from 1 to 1000. Bans do not expire. They are stored in ip_bans.yaml in the configuration folder, and you clear one by removing its entry or deleting the file. If your instance is reachable from the internet and you have never set a limit, the first fix does nothing for you until you do.