Hundreds of Genie Aladdin Connect garage doors suddenly appeared inside strangers’ Home Assistant setups, marking the second cross-account data exposure for the platform in about three years.
Foreign garage doors appeared inside Home Assistant overnight
The problem started on September 6 at about 03:43 UTC, when owners of Genie’s Aladdin Connect controllers began seeing garage doors that were not theirs inside their Home Assistant setups. Two different people logged the first foreign device in their Home Assistant device lists at 03:43:25 and 03:43:27 UTC, down to the second. At that same moment, their own doors went unavailable in Home Assistant, even though the Aladdin Connect mobile app kept showing and operating their real doors normally.
Through the night, the number of stranger doors kept growing for affected users. People reported seeing lists with 44, 107, 147, 188, 250, 256, 305, 306 and 425 devices, and one person said they passed 600 entities before turning the connection off. These were not just random names, either. The foreign doors arrived with live state, including open or closed position, battery level, and link status.
Some exposed doors carried street addresses as names
The data leak was personal enough that it sometimes revealed where people lived. Some of the foreign doors carried names that appeared to be street addresses. Two different users independently saw the same street address in their lists, which strongly suggests everyone was drawing from a single shared pool of other customers’ devices.
For many households, the reach of the problem did not stop at Home Assistant. A lot of people bridge their Home Assistant setups to Alexa, so the phantom doors showed up as new Alexa devices. Users described waking up to a flood of “device connected and ready to control” notifications and then spending time later deleting long lists of stray garage doors from Alexa. Those Alexa entries proved stubborn for some. One user reported that hundreds of stray doors were still listed in their Alexa account even after Home Assistant was working normally again, and that the bulk-removal scripts other commenters shared did not clear them. Reports came from people running different Home Assistant versions, including 2026.8.3 and 2026.9.0, which points to Genie’s cloud response as the source instead of any single Home Assistant release.
Genie blames an API Gateway cache change driven by cost
Later the same day, a Home Assistant contributor named Jamie Magee, who re-added the Aladdin Connect component to Home Assistant, posted that Genie had contacted him to work on the problem. According to his public note, Genie had recently turned on API Gateway caching to limit the cost impact of Home Assistant’s frequent polling of its cloud API. Genie told him it rolled that change back and suspects that cache setting led to customers receiving other people’s door lists.
Genie’s own position, as relayed in that post, is careful on the most sensitive parts. The company is still investigating, and the extent of the data exposure and any impact on door commands is still unconfirmed. Genie is also looking into a callback-style API, which would let its servers notify Home Assistant of changes instead of responding to constant polling. The stated motivation for the original caching change was cost control, not speed.
Could anyone actually open a stranger’s door? No clear answer yet
The question everyone cares about most, whether anyone could actually operate someone else’s garage door, is still unresolved. Some users said the foreign doors appeared in Home Assistant as fully controllable “cover” entities, with open and close controls just like their own door. That presentation suggests control, but it only shows what the Home Assistant side offered, not what Genie’s servers would accept.
At least one person deliberately tried to actuate a single foreign door and reported that its state never changed, which points to read-only access in that one case. Others said the foreign doors showed up as unavailable from the start and could not be triggered at all. No one in the thread reported a stranger actually opening their garage door. Genie’s public stance, through Magee’s note, is that any impact on door commands is still unconfirmed, so there is no firm answer either way.
One user’s testing points to a mis-keyed cache on Genie’s servers
One technically minded user decided to measure Genie’s API responses directly using their own account token. Every request they made returned as a cache miss at the content delivery network edge, with a unique request identifier, which suggests the edge was not serving stale data. Instead, the origin servers behind Genie’s API were apparently resolving their valid token to the wrong customer account and returning that other person’s devices.
They also noticed a time pattern. The wrong account stayed the same for about five minutes before flipping to a different one, which matched a five-minute cache lifetime. Their conclusion was that some server-side cache was keyed on something shared by all Home Assistant users, rather than on each person’s own token. That lines up with Genie’s own explanation about enabling API Gateway caching, though this testing is still one user’s measurement and hypothesis, not an official root cause report.
By about 22:00 UTC on September 6, people started reporting that their Home Assistant setups were back to normal and that their own garage doors were showing correctly again. Reloading the Aladdin Connect component, or deleting and re-adding it, cleared out the foreign devices. No one needed to change their password to fix the wrong-door lists, even though some people chose to do that anyway. The original issue report stayed open so the reporter could keep an eye on stability over time.
This is the second cloud API cross-account exposure in about three years
For Genie, this is not the first time its cloud-side controls have mixed up who can see what. On January 3, 2024, security firm Rapid7 published an advisory about multiple Aladdin Connect issues that had been reported the prior year to Overhead Door, Genie’s parent company. Three of those problems were fairly traditional: an Android app that stored user passwords in clear text, a cross-site scripting bug in the ALDCM retrofit kit, and an unauthenticated configuration page on the Garage Door Control Module, all of which received specific fixes.
The fourth problem in that advisory is the one that connects most directly to what just happened. Rapid7 had found that an authenticated user could query Genie’s service API with different device IDs and pull back other customers’ device data. Genie says its own internal penetration testing caught that one, and the API fix went in on July 25, 2023, about a month before Rapid7 filed its report. The latest incident falls into the same general class of failure, cross-account data exposure through the cloud API, roughly three years after a similar problem was found and fixed, even though the mechanisms differ. The earlier issue relied on someone querying other device IDs, while this one appears tied to a caching layer handing the wrong account to the right token.
For garage doors, locks, and cameras, many Home Assistant users in the thread landed on the same takeaway: lean toward local control instead of cloud accounts when the stakes are high. When a device depends on a vendor’s cloud, your security rests on that vendor’s servers making the right decision about “which devices are yours” on every single request. One change to a cache setting can suddenly affect countless homes at once, with no warning in your app, no alert on your Wi-Fi, and nothing you can tweak on your router to stop it.
Commenters said this incident pushed them to rethink how they connect their homes. One person called it a prime example of why Genie should offer a local API instead of pushing everything through the cloud. Another said they did not want to share an API space with other customers at all. Others wrote that they would start looking for fully local setups or simple relay-based garage controllers that do not depend on a shared vendor service.
For people shopping or planning upgrades, that usually means picking devices that can talk locally over Matter, Zigbee, or Z-Wave instead of needing a cloud-only phone app, and running a local hub to tie them together. For cameras, it can mean recording to a local network video recorder on your own network instead of sending every clip to a vendor cloud. For garage doors, it can mean a controller that just drives a dry-contact relay and reads separate position sensors, so you still know if the door is open or closed without logging into someone else’s servers.
There is a real tradeoff here, not a free win. Cloud-connected systems make remote access easy and pack in app features with almost no setup. Local-first systems give you more control over where your data goes, but if you want to check your door or camera from outside the house, you have to add that access yourself, for example by using a VPN into your home network. A sloppy VPN setup or an exposed router port introduces its own risks. The Genie incident shows what can happen when a cloud setting goes wrong, but the choice between cloud convenience and local control is still one each homeowner has to weigh for themselves.
