Music Assistant tightens sign-ins through Home Assistant’s sidebar so another process on the host cannot impersonate a user by sending identity headers to the same address. Those headers are trusted only when the request comes through Supervisor’s proxy.
Marvin Schenkel also requires Home Assistant to confirm the username before matching or creating an account that has not been linked before. Already linked accounts keep their existing sign-in behavior. On a Home Assistant OS test installation, the correction refused a forged request while normal sidebar and integration access still worked.