CVE-2026-119703

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

EUVD-2026-114108

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

CVE-2026-119703

The xiaozhi-esp32-server (through version 0.9.8 ) is vulnerable to an authentication bypass in the WebSocketServer._handle_auth function. This flaw allows remote unauthenticated attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-sha...