18 matches found
PYSEC-2026-4049 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...
ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access
ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy. id: CVE-2026-59177 info: name: ESPHome Device Builder 1.0.10 -...
CVE-2026-59178
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
CVE-2026-59178
ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...
CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
EUVD-2026-77758
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
GHSA-RRXG-G2PF-6HH4 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...
Missing Authentication for Critical Function
Overview esphome-device-builder is an ESPHome Device Builder Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the DashboardSettings.parseargs process when only legacy environment variables are set. An...
PT-2026-91396
Name of the Vulnerable Software and Affected Versions ESPHome Device Builder Dashboard versions prior to 1.0.12 esphome container versions prior to 2026.6.2 Description An authentication bypass occurs when upgrading the dashboard because the system stopped supporting the legacy $USERNAME and...
CVE-2026-59178: Missing Authentication for Critical Function
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...
PYSEC-2026-3834 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
SummaryOn the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...
Binding to an Unrestricted IP Address
Overview esphome-device-builder is an ESPHome Device Builder Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address via the dashboard process. An attacker can gain full control over the application environment, including executing arbitrary code and accessing or...