2FA for Web log in

[neonturbo]

Welcome to the forums.

This has been addressed. More information here:

Write up from last years security update

Hello, I am the security researcher who report the issue described in the notice here. A write up of what was found and how it could have been exploited is now available. https://ostrichlab.io/research-blog/?post=hubitat_writeup If you haven't updated to at least 2.4.2.157, please do so now! I do want to thanks @bobbyD and @gopher.ny for being quick and professional.

New CVE-2026-1201 (platform vulnerability was fixed in Aug 2025)

I just got the notice about a new CVE against Hubitat. I am new to the forum and I have not seen much mentioned about CVE's. CVE-2026-1201 if you search for it you will see the details. Anyone else track CISA news? thanks- =========== An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side…