Zigbee2MQTT MQTT Broker Security: A Practical Checklist
A practical checklist for securing Zigbee2MQTT's Mosquitto broker and frontend, from the add-on's anonymous-access default onward. Every fix stays local.
~/archive $ ls -la
Archive
Security
-
-
Xiaomi Cloud Tokens Extractor Stuck on 2FA? Here’s the Fix
Xiaomi Cloud Tokens Extractor stuck in a 2FA login loop? Here's the update that clears it, the official checklist, and the DevTools workaround.
-
Aqara Cloud CVE Chain (June 2026): What It Means for Local-First Users
Aqara's June 2026 cloud CVEs chain into an account-takeover path. Here's how the chain works, who's exposed, and why local Z2M/ZHA setups sit outside it.
-
Aqara Hub Security Patch Status: Are the 2025 CVEs Fixed?
Three CVEs hit the Aqara Hub M2, M3, and Camera Hub G3 in December 2025. Here's what's actually patched, what's still unclear, and what to do.