CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer.handleauth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...