ZoomEye finds 2.7 million Home Assistant installs exposed online

ZoomEye recorded 2,711,859 fingerprint matches for Home Assistant as of September 23, 2026. The local-first smart home platform, which controls locks and cameras, is often reachable from the internet via port forwards and reverse proxies, creating physical-world risk.

• ZoomEye: 2,711,859 matches for the app="Home Assistant" fingerprint
• Port 8123 is the documented default for the Home Assistant web interface
• Long-lived access tokens never expire and are rarely audited
• VPN or managed tunnel plus MFA recommended over port forwarding