The Kasa firmware update from TP-Link's CVE-2026-108473 advisory (CVSS 8.7, High) covers 23 listed plugs, switches, bulbs and strips. After updating, some Home Assistant users find devices unavailable until they re-authenticate. Update, then check Third-Party Compatibility in the vendor app.
What has changed in the Kasa firmware?
TP-Link's security advisory, last updated on 14 October 2026, lists fixed firmware for 23 Kasa product lines under CVE-2026-108473, scored 8.7 (High) on CVSS v4.0. The advisory page gives the affected hardware versions and fixed build numbers but, in the version we read, no technical description of the flaw, so we are not guessing at one. A sample of the fixed builds:
Check the advisory for your exact model and hardware version before assuming you are covered. If you own the cameras instead, that is a separate advisory, covered in our Kasa EC70 and EC71 vulnerabilities article.
Why does a Kasa firmware update break Home Assistant?
Newer Kasa firmware requires authentication for local control, and Home Assistant has to log in with your TP-Link cloud account. The Home Assistant TP-Link integration documentation says newer devices need your cloud username and password for local access, and that some firmware blocks Home Assistant until Third-Party Compatibility is switched on in the vendor app.
Users on the Home Assistant community forum have reported Kasa switches and HS300 power strips failing with "Unable to authenticate: Device response did not match our challenge" after a Kasa update. TP-Link's advisory does not mention Home Assistant, and TP-Link support has reportedly said it does not support it, so the link between this particular patch and those reports is community-reported rather than confirmed.
How do you get Kasa devices working in Home Assistant again?
Work through these in order, stopping when the device returns:
- Enable Third-Party Compatibility. Open the Kasa app, go to Settings, and make sure the toggle is on. If it already is, switch it off, wait a few minutes, then switch it back on. This briefly disconnects other third-party services.
- Re-enter your credentials. In Home Assistant, use Settings, Devices & Services, reconfigure the TP-Link integration, and enter your TP-Link account email exactly as registered. The email is case-sensitive.
- Re-add by IP address. One forum user changed their Kasa password, set the devices up again in the Kasa app, and added them to Home Assistant by IP only. Give the devices a DHCP reservation first so the address does not change.
- Expect a repeat after power loss. Some HS300 owners say the toggle fix has to be repeated whenever the strip loses power.
Should you update Kasa firmware or hold off?
If a device is exposed to untrusted users on your network, update, because the advisory rates the flaw High. If it sits on a trusted, segmented IoT VLAN and Home Assistant control matters more, waiting a few days to read community reports for your model is reasonable. Kasa devices can auto-update, so check the firmware version in the app before you assume anything.
Home Assistant's documentation notes that older Kasa devices that do not require authentication can stay that way if you disable automatic firmware updates, but that also means skipping security fixes. If this keeps happening, a locally controlled alternative avoids the problem entirely: see our best smart plugs UK guide or the Shelly Plug S review for options that do not rely on a cloud login. For bulbs, our Kasa smart bulbs review and Kasa vs Philips Hue comparison cover the trade-offs.
What we don't know yet
Home Assistant users are the most exposed, because local control depends on the device accepting the integration's login. TP-Link has not published, in the advisory we read, what the vulnerability is or whether the new firmware deliberately tightens local authentication. Nor does it say which firmware builds trigger the Home Assistant errors. We will update this article if either becomes clear.
Frequently asked questions
- Do I need to update my Kasa plugs and switches for CVE-2026-108473?
- If your model and hardware version appear in TP-Link's advisory, yes, you should update. CVE-2026-108473 is scored 8.7 (High) on CVSS v4.0, and TP-Link lists fixed firmware for 23 product lines including the HS103, KP115, HS300, HS220 and KL125. The advisory we read does not describe the flaw itself, so we cannot say how easily it could be exploited at home. The caveat is Home Assistant: some users report that updated devices stop responding until Third-Party Compatibility is toggled and the integration is re-authenticated. If your home network is small and trusted, updating promptly and fixing Home Assistant afterwards is the safer order. Check the firmware version in the Kasa app first, because devices may already have updated themselves overnight without telling you.
- Where is the Third-Party Compatibility setting in the Kasa app?
- Home Assistant's TP-Link documentation says the setting is found under Settings in the Kasa app, and under Tapo Lab in the Tapo app. Forum users also describe it as Me, then Settings, then Third-party Compatibility. Menu names change between app versions, so look for the exact wording rather than a fixed path. Make sure it is switched on. If devices are still unavailable in Home Assistant, several users report that switching it off, waiting a few minutes, then switching it back on re-creates the authentication handshake. Be aware that doing this briefly disconnects other third-party services linked to your account, such as voice assistants. TP-Link has said it does not guarantee the feature works with unofficial platforms, so treat it as a workaround rather than a promise.
- Why does Home Assistant say 'Device response did not match our challenge' for Kasa?
- That message is an authentication failure: the Kasa device answered Home Assistant's login request in a way the integration could not verify. Community reports link it to Kasa firmware updates that reset or tighten the device's local authentication, though TP-Link has not confirmed that cause. Home Assistant's documentation says newer Kasa and Tapo devices need your TP-Link cloud username and password, and that the email is case-sensitive, so first re-enter the credentials exactly as registered. If that fails, toggle Third-Party Compatibility in the vendor app, or re-add the device using only its IP address. The honest limitation is that fixes can be temporary: some HS300 power strip owners say the problem returns after the strip loses power.
- Can I stop Kasa devices updating their firmware automatically?
- Home Assistant's documentation says older Kasa devices that do not yet require authentication can keep working that way if you disable automatic firmware updates in the vendor app, or if you factory reset them and block their internet access. That keeps Home Assistant control stable, but it also means you will not receive security fixes such as the one covered by CVE-2026-108473. The trade-off depends on your network: a device on an isolated IoT VLAN with no internet access is a smaller risk than one on your main network. Once a device has already updated to an authenticated firmware, you generally cannot roll it back, so the realistic option is to re-authenticate rather than downgrade.
›How we researched this
Claims in this article are checked against primary sources — manufacturer specifications, official documentation, Which? research, Ofgem guidance, or gov.uk — rather than forum threads or video reviews. Where the author has direct hands-on experience with a product (most Home Assistant, Zigbee, and home-networking gear is running in his own homelab), that is stated explicitly in the text.
For categories outside that personal setup — such as boilers, heat pumps, and other areas that are traditionally a heating engineer's domain — verdicts are built from cross-referenced manufacturer data, published lab results, and vetted expert and owner reviews rather than a claim of personal hands-on testing. See the editorial policy for the full methodology.
Citing this page? Please use a dofollow link back to the original article — it helps us keep the data on this page accurate and up to date.
