Critical Security Flaw in Rently Smart Home Locks Exposes Master PINs

Rently Smart Home Just Became a Case Study in Why Your Hub Matters

According to the agency, Rently Smart Home versions 20.1.0 and prior carry an Insufficiently Protected Credentials vulnerability, tracked as CVE-2026-75960, that could let attackers pull master PINs straight off the device and override user permissions entirely. In other words: the keys to the castle, served on a silver platter, courtesy of a credential handling implementation that apparently skipped the encryption memo.

What the flaw actually exposes

The vulnerability lives in how the platform guards its most sensitive strings — the master PIN codes that govern property access in Rently's rental-focused smart lock ecosystem. Because those credentials aren't sufficiently protected at rest or in transit, an attacker who reaches the device can extract them without needing elevated privileges. Once those PINs are in hand, the "override user permissions" part of the advisory becomes the nightmare scenario: an unauthorized party can effectively bypass the access controls the rest of the system relies on.

This isn't a theoretical edge case. Rently's hardware is deployed across rental properties, multifamily housing, and short-term stays — exactly the environments where a compromised lock translates into real-world entry. When the credential vault leaks, the trust model collapses.

Why this matters beyond Rently walls

Here's the angle that should hit home for anyone wiring together a connected living space: the hub-or-lockbox ecosystem you pick is only as strong as its weakest credential handler. The Rently CVE is a textbook reminder that "managed by a third party" is not the same as "secured by design." Property managers running Rently on 20.1.0 or earlier need to audit firmware versions, rotate any master PINs currently in circulation, and watch for a vendor patch — the advisory makes clear prior releases are in scope, so staying on legacy firmware is not a strategy.

For the broader smart home crowd, the timing is pointed. Hub platforms are proliferating, and each one promises convenience while quietly accumulating the credentials, PINs, and override tokens that gate your physical and digital life. A vulnerability like this doesn't just affect one vendor — it sharpens the question every tinkerer should be asking: does my stack treat secrets like secrets, or like config strings someone forgot to wrap in a vault? Audit your firmware, rotate your codes, and treat every "managed credential" feature with the suspicion it deserves.