CVE-2026-119755

Tasmota versions through 16.0.0 (fixed in commit 1cb7ebc ) are vulnerable to a cross-site request forgery (CSRF) vulnerability in the HttpCheckPriviledgedAccess() function. The root cause is a failure in Referer-based CSRF protection , where an attacker can bypass security by crafting a Referer h...

EUVD-2026-120124

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess by crafting a Referer header where the device hostname or IP appears as a substring...