Suddenly getting Re-authentication required error in HAOS

[cm-mojo]

Describe the issue you are experiencing

Mosquitto has been running fine, then all of a sudden i get this error in HA:

No changes have been made to the user account in HAOS - it stated one 2025.5.2 was installed however i've rolled back to previous backups and its still persisting. i have removed and re-added the user and still getting the same issue. no MQTT devices can connect. I've tried creating a new user and its still not working, i tried logging in with my own user rather than the specific MQTT user, and again that has the same issue.

What type of installation are you running?

Home Assistant OS

Which operating system are you running on?

Home Assistant Operating System

Which app are you reporting an issue with?

Mosquitto broker

What is the version of the app?

7.1.0

Steps to reproduce the issue

1.login to HAOS
2.Wait for MQTT Broker to start
3. error appears in HAOS - log file shows connection attempts failing with unauthorised user.
...

System Health information

System Information

version	core-2026.5.1
installation_type	Home Assistant OS
dev	false
hassio	true
docker	true
container_arch	aarch64
user	root
virtualenv	false
python_version	3.14.2
os_name	Linux
os_version	6.12.75-haos-raspi
arch	aarch64
timezone	Europe/London
config_dir	/config

Home Assistant Community Store

GitHub API	ok
GitHub Content	ok
GitHub Web	ok
HACS Data	ok
GitHub API Calls Remaining	4984
Installed Version	2.0.5
Stage	running
Available Repositories	3070
Downloaded Repositories	41

Home Assistant Cloud

logged_in	false
can_reach_cert_server	ok
can_reach_cloud_auth	ok
can_reach_cloud	ok

Home Assistant Supervisor

host_os	Home Assistant OS 17.3
update_channel	stable
supervisor_version	supervisor-2026.05.0
agent_version	1.8.1
docker_version	29.3.1
disk_total	219.4 GB
disk_used	14.3 GB
nameservers	192.168.0.1
healthy	true
supported	true
host_connectivity	true
supervisor_connectivity	true
ntp_synchronized	true
virtualization
board	rpi4-64
supervisor_api	ok
version_api	ok
installed_addons	Matter Server (8.4.0), Terminal & SSH (10.2.0), GivTCP-BETA (3.3.15), Studio Code Server (6.0.1), CEC Scanner (4.0), Everything Presence Zone Configurator (2.1.0), Home Assistant Google Drive Backup (0.112.1), AppDaemon (0.18.5), eufy-security-ws (2.1.0), Samba share (12.6.1), Node-RED (21.0.10), Bluelink Token Generator (6.6.6), Mosquitto broker (7.1.0)

Dashboards

dashboards	4
resources	13
views	29
mode	storage

Network Configuration

adapters	lo (disabled), end0 (enabled, default, auto), hassio (disabled), docker0 (disabled), veth872d328 (disabled), veth7edebb0 (disabled), vethdd6558f (disabled), veth8414a74 (disabled), veth990439d (disabled), vethaa4339d (disabled), vethd00ab54 (disabled), vethd150b61 (disabled), veth8516c24 (disabled), vethc47f8e1 (disabled), veth8112a69 (disabled), vethde8896c (disabled)
ipv4_addresses	lo (127.0.0.1/8), end0 (192.168.0.166/24), hassio (172.30.32.1/23), docker0 (172.30.232.1/23), veth872d328 (), veth7edebb0 (), vethdd6558f (), veth8414a74 (), veth990439d (), vethaa4339d (), vethd00ab54 (), vethd150b61 (), veth8516c24 (), vethc47f8e1 (), veth8112a69 (), vethde8896c ()
ipv6_addresses	lo (::1/128), end0 (fe80::8131:62b9:4246:90c2/64), hassio (fd0c:ac1e:2100::1/48, fe80::64ca:edff:fe16:13b7/64), docker0 (fe80::18ad:f0ff:fe9b:d48e/64), veth872d328 (fe80::7056:afff:fe59:1468/64), veth7edebb0 (fe80::142d:7cff:fef5:4d86/64), vethdd6558f (fe80::c060:beff:fe3c:dce9/64), veth8414a74 (fe80::e855:a0ff:fe58:c3e9/64), veth990439d (fe80::4817:a6ff:fe6a:6c26/64), vethaa4339d (fe80::a892:71ff:feca:7da2/64), vethd00ab54 (fe80::5c08:7bff:fe49:411b/64), vethd150b61 (fe80::186d:f8ff:fece:8a5b/64), veth8516c24 (fe80::b464:4fff:febc:c924/64), vethc47f8e1 (fe80::b0bd:85ff:fe95:953e/64), veth8112a69 (fe80::f82d:77ff:fecf:bd64/64), vethde8896c (fe80::2cef:51ff:fe96:88b/64)
announce_addresses	192.168.0.166, fe80::8131:62b9:4246:90c2

Recorder

oldest_recorder_run	7 May 2026 at 07:02
current_recorder_run	18 May 2026 at 10:54
estimated_db_size	2259.67 MiB
database_engine	mysql
database_version	10.11.11

Sonoff

version	3.11.1 (66624ed)
cloud_online	18 / 20
local_online	14 / 14

Anything in the Supervisor logs that might be useful for us?

2026-05-18 10:59:57.232 INFO (MainThread) [supervisor.auth] Auth request from 'core_mosquitto' for 'hamqtt'
2026-05-18 10:59:57.256 WARNING (MainThread) [supervisor.auth] Unauthorized login for 'hamqtt'

Anything in the app logs that might be useful for us?

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
cont-init: info: running /etc/cont-init.d/mosquitto.sh
[10:45:04] INFO: SSL is not enabled
cont-init: info: /etc/cont-init.d/mosquitto.sh exited 0
cont-init: info: running /etc/cont-init.d/nginx.sh
cont-init: info: /etc/cont-init.d/nginx.sh exited 0
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun mosquitto (no readiness notification)
services-up: info: copying legacy longrun nginx (no readiness notification)
[10:45:04] INFO: Starting NGINX for authentication handling...
s6-rc: info: service legacy-services successfully started
[10:45:05] INFO: Starting mosquitto MQTT broker...
2026-05-18 10:45:05: Info: running mosquitto as user: root.
2026-05-18 10:45:05: Warning: Mosquitto should not be run as root/administrator.
2026-05-18 10:45:05: Restored 5771 base messages
2026-05-18 10:45:05: Restored 5771 retained messages
2026-05-18 10:45:05: Restored 0 clients
2026-05-18 10:45:05: Restored 0 subscriptions
2026-05-18 10:45:05: Restored 0 client messages
2026-05-18 10:45:05: mosquitto version 2.1.2 starting
2026-05-18 10:45:05: Config loaded from /etc/mosquitto/mosquitto.conf.
2026-05-18 10:45:05: Bridge support available.
2026-05-18 10:45:05: Persistence support available.
2026-05-18 10:45:05: TLS support available.
2026-05-18 10:45:05: TLS-PSK support available.
2026-05-18 10:45:05: Websockets support available.
2026-05-18 10:45:05: Loading plugin: /usr/share/mosquitto/go-auth.so
2026-05-18 10:45:05: ├── Username/password checking enabled.
2026-05-18 10:45:05: ├── TLS-PSK checking enabled.
2026-05-18 10:45:05: └── Extended authentication not enabled.
2026-05-18 10:45:05: Plugin has registered to receive 'reload' events.
2026-05-18 10:45:05: Plugin has registered to receive 'basic-auth' events.
2026-05-18 10:45:05: Plugin has registered to receive 'acl-check' events.
2026-05-18 10:45:05: Plugin has registered to receive 'psk-key' events.
2026-05-18 10:45:05: Opening ipv4 listen socket on port 1883.
2026-05-18 10:45:05: Opening ipv6 listen socket on port 1883.
2026-05-18 10:45:05: Opening ipv4 listen socket on port 1884.
2026-05-18 10:45:05: Opening ipv6 listen socket on port 1884.
2026-05-18 10:45:05: mosquitto version 2.1.2 running
2026-05-18 10:45:06: New connection from ::1:47088 on port 1883.
2026-05-18 10:45:06: Protocol error from ::1:47088: First packet not CONNECT (0A).
2026-05-18 10:45:06: Client ::1 [::1:47088] disconnected: protocol error.
2026-05-18 10:45:06: New connection from 192.168.2.165:56421 on port 1883.
2026-05-18 10:45:06: Client awtrix_96877c [192.168.2.165:56421] disconnected: not authorised.
[10:45:06] INFO: Successfully send discovery information to Home Assistant.
[10:45:07] INFO: Successfully send service information to the Supervisor.

### Additional information

_No response_

[cm-mojo]

Note that if i add the user in the mqtt configuration, rather than letting HAOS manage the user, it all works - which is fine, just wondering why all of a sudden it won';t use the HA users

[crag364]

Same issue here — HA OS 17.3, HA Core 2026.5.4, Supervisor 2026.05.0, Mosquitto 7.1.0

Started after updating to HA 2026.5.4. All Tasmota MQTT clients suddenly began failing with not authorised despite correct credentials.

Supervisor log showed:

WARNING [supervisor.auth] Unauthorized login for 'mqtt'

HA Core log showed:

ERROR [homeassistant.components.hassio.auth] Invalid auth request from Supervisor

The Supervisor's go-auth plugin is unable to validate any regular HA user accounts against HA Core. The homeassistant system account connects fine but all user-based logins fail.

Things that did NOT fix it:

• Deleting and recreating the MQTT user
• Restarting Mosquitto
• Uninstalling and reinstalling Mosquitto
• Deleting the MQTT integration and reinstalling Mosquitto
• Running ha supervisor repair
• Full host reboots (multiple)

Workaround that works:
Add a hardcoded login in Mosquitto's Configuration tab, bypassing Supervisor auth entirely:

logins:
  - username: mqtt
    password: yourpassword
log_dest: []
log_type: []
require_certificate: false
certfile: fullchain.pem
keyfile: privkey.pem
customize:
  active: false
  folder: mosquitto

All clients reconnected immediately. This appears to be a Supervisor 2026.05.0 bug breaking the auth chain between Mosquitto's go-auth plugin and HA Core.

[ScriptHippie]

HAOS 17.3 on UTM on Mac Mini.
Same issue here, started immediately after updating from HA core 2026.6.1 to 2026.6.2. Weird that the problem seems to somehow gets triggered by a core update; I had installed all previous HA core sub/main releases w/o any issue.

What makes this bug really serious is that it cannot be fixed by installing a previous automated backup, so the occurrence of the bug requires manual intervention and/or extensive research, with possibly downgrading to a core version many months old.

Confirming the workaround from @crag364 and @cm-mojo via entering user credentials directly in Mosquitto Broker's yaml file.

Adding to the list of things that did NOT fix it:

• creating a new user in HA and substituting this new user's credentials for the former user account in Z2M's config

My symptoms were Zigbee2MQTT not being able to connect to the MQTT Broker, as indicated by log entries in both apps with the same timestamp. Z2M in consequence could not launch.

[plandregan]

Been seeing this a few weeks now. I build dashboard fro many users, i use my HACS to get the lovelace cards for it.
after a while they need to re-authenticate.
So i get called back to re do it

[pieterdevriesch]

I had this today, which is strange because I updated and restarted regularly in between. Fortunately the fix from @crag364 worked perfectly, after adding an additional reboot.

[compunix-be]

Updated from 2026.4.x to 2026.6.4 earlier this week. At first all working fine, this morning mqtt re-authentication required.
Noticed the problem with DSMR from smartmetergateway no longer communicating.
Workaround from @crag364 worked also for me.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.