Z-Wave JS stops accepting an Alarm Sensor report as another device’s message solely because it names that device inside the report. Previously, even a node without a secure connection could inject an alarm attributed to another node and bypass that node’s security class.
The driver now drops a report when its embedded source identifies someone other than the sender, unless that source field is zero. Legitimately forwarded reports are also rejected because the forwarding cannot be verified.