Medium severity4.8NVD Advisory· Published Oct 30, 2026
CVE-2026-119703
CVE-2026-119703
Description
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.
Patches
Vulnerability mechanics
References
4- github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.pynvd
- github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448nvd
- github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457nvd
- www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-headernvd
News mentions
0No linked articles in our index yet.