Update to 2026.6.1 Causes Login Failures

Installation
21

I seem to be getting the same as others describe here.
Since updating Core to 2026.6.1, opening any dashboard view that contains camera views produces these:

Login attempt failed
Login attempt or request with invalid authentication from laptop (192.168.5.73). See the log for details.

2 seconds ago

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:138
Integration: HTTP (documentation, issues)
First occurred: 10:48:23 (5 occurrences)
Last logged: 10:49:02

Login attempt or request with invalid authentication from laptop (192.168.5.73). Requested URL: '/api/camera_proxy_stream/camera.camgarden_garden?token=undefined'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from laptop (192.168.5.73). Requested URL: '/api/camera_proxy/camera.camgarden_garden?authSig=Token&width=0&height=0'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from laptop (192.168.5.73). Requested URL: '/api/camera_proxy/camera.camfront_front?authSig=Token&width=498&height=0'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from laptop (192.168.5.73). Requested URL: '/api/camera_proxy/camera.camlivingroom_livingroom?authSig=Token&width=0&height=0'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from laptop (192.168.5.73). Requested URL: '/api/camera_proxy/camera.camfish_fish?authSig=Token&width=0&height=0'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36)

I see the same whether local or remote, using the HA app or a browser, accessing either through nginx or directly to HAs local address.

I've added to the existing github issue here

edit: ..and then I find this issue, that's already lead to this

22

It was me who posted this issue at github at Repeated failed logins from loading live videos · Issue #173202 · home-assistant/core · GitHub
I was lucky that I do not use ip_ban, and I was never banned.
You have to set ip_ban to false till they fix this issue that have to do with loading live cameras or images on dashboard.

23

I tested that theory yesterday and did not get the same results?

http:
  use_x_forwarded_for: true
  trusted_proxies:
     - 172.30.33.0/24   
     - 172.30.32.0/24 
  ip_ban_enabled: true

image
image1352×795 234 KB

24

This is interesting. I do not set ip_ban at all in my config. I do not have ip_ban anywhere in my config.

25

I do not have ip_ban anywhere in my config files either. I do have
auth_providers:
- type: trusted_networks
trusted_networks:
with some IP/32's.
and trusted_users bound to some of those /32's in the trusted_networks section.

I do have a dashboard running on three tablets configured to auth this way. It rotates through camera feeds and runs all the time. Getting this in the logs:

2026-06-10 21:15:08.415 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.x.y (192.168.x.y). Requested URL: '/api/camera_proxy/camera.front_low_resolution_channel?token=blahblah&_t=1781140508130'. (Mozilla/5.0 (Linux; Android 11; KFTUWI Build/RS8338.3339N; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/146.0.7680.219 Safari/537.36)

26

I logged out and it made me create a unique device_tracker to get back in

27

Twenty six posts later and nobody has said what router they have?

Has 2026.6.2 fixed the issue?

28

Sorry for the delay. I am running Core 2026.6.2 with 2026.06.1 Supervisor, 17.3 OS and frontend 20260527.5 and I do have this problem.

29

Have exactly the same issue. Login from pc or iphone. Both local and remote using Nebu Casa

30

Same here. Local ips and extern ips get banned. Using cloudflared and a fritz.box 6591.

31

Core 2026.6.3 fixes it for me​:white_check_mark:

32

Update to 2026.6.3 - fixed it for me

33

Indeed look like 2026.6.3 fixes the issue, haven't seen a single failed login message as yet - running it for 10 hours now.

34

Looks like this has returned.

  • Core2026.7.0
  • Supervisor2026.06.2
  • Operating System18.1
  • Frontend20260624.3
35

it still happens,

my system :slight_smile:

  • Installation method : Home Assistant Container (Docker)
  • Core 2026.7.4
  • Frontend : 20260624.6

But i trying throug Cloudflare tunnel , with Android HA APP (latest)
internal\LAN acess to HA works perfect fine

Tanks

SOLVED :

(hope it helps someone)
→ Using Cloudflare, Home Assistant Core and SSL - #2 by pedrobuenoxs

Allow your IPs that may be found on error message :wink:

36

I have this problem since a few months (or a very similar one since mine was not resolved at the beginning of June like others seem to have confirmed).

Here is the error I see in the logs:

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:138 
Integration: HTTP ([Documentation](https://www.home-assistant.io/integrations/http), [Issues](https://github.com/home-assistant/core/issues?q=is%3Aissue+is%3Aopen+label%3A%22integration%3A+http%22)) 
First occurrence: 20:29:19 (1 occurrence) 
Last record : 20:29:19

 Login attempt or request with invalid authentication from tab-s3.home.domain.net (192.168.1.153). Requested URL: '/api/camera_proxy_stream/camera.reolink_rlc_81ma_snapshots_fluent?token=xxxxx'. (Mozilla/5.0 (Linux; Android 13; SM-T820 Build/TQ3A.230901.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/153.0.8010.5 Safari/537.36)

Really getting tired of those notifications.

I’m on latest HA version. HA OS.
I do have a dashboard on that Tab-S3 device that shows that Reolink camera stream.

Any idea?
Thank you