Smart Locks and Bluetooth: Relay Attacks, Risks, and Home Security

What’s Confirmed and What Isn’t

• New vulnerability from November 1, 2026: I couldn’t find any reports from BleepingComputer or The Hacker News about a new flaw in the BLE protocol and smart locks from that date.
• Origin of the story: In 2022, NCC Group demonstrated a relay attack at the connection layer of Bluetooth Low Energy. This affects systems that use Bluetooth for proximity verification: smart locks, cars, and access control systems.
• Nuki lock vulnerabilities: In 2022, the NCC Group documented 11 vulnerabilities (for example, CVE-2022-32507, severity 8.0, missing permission checks in the BLE interface). According to reports, the manufacturer fixed them in the summer of 2022. A more recent article presented them as an incident from 2026, but the CVE-2022 designation points to the year 2022.

How a relay attack works

The lock verifies that a phone is nearby and unlocks. An attacker with two inexpensive devices can trick the lock into thinking the phone is closer than it actually is: one device is near your phone, the other is near the lock, and they relay signals between each other. The lock then “sees” the phone as being nearby, even though it’s far away. The encryption isn’t broken—the data is simply relayed.

Why an Update Isn’t Enough

Specific lock vulnerabilities (such as those from 2022) can be resolved with a firmware update. However, the relay attack is a weakness inherent in Bluetooth proximity verification itself, which a patch alone cannot fix. The real defense is to change the verification method—for example, by requiring user action.

The Reality of the Risk

• The attack requires targeted preparation; the attacker must be in close proximity to both the phone and the lock at the same time. For the average owner, the risk is low, but for targeted attacks, it is not zero.
• The attack may be inconspicuous, but it will likely leave a record in the lock’s history.
• A smart lock isn’t automatically less secure than a traditional lock; it simply has a different risk profile.

What You Can Do

1. Turn off automatic proximity unlocking, or replace it with unlocking via a tap in the app.
2. Update the firmware for both the lock and the app.
3. Enable two-factor authentication (PIN, fingerprint, app confirmation) if your lock supports it.
4. Monitor the unlock history and notifications.
5. Don’t rely solely on a smart lock for valuable property; add a mechanical lock.
6. Revoke old shared access permissions.
7. When purchasing, ask about the authentication method and the duration of security update support.

How to Spot a Recycled Security Alert

• Check the date in the original source and the CVE number.
• Look for an announcement from the manufacturer or a research firm, not just reposts.
• Be wary of “anywhere in the world.” A relay attack requires devices both near you and near the lock.

What to Take Away

The new critical vulnerability reported on November 1 has not been confirmed. However, the risk exists and is nothing new: Bluetooth proximity verification can be spoofed. A sensible defense is to disable automatic unlocking, add an extra authentication factor, and update your software.