CVE-2026-119703

The xiaozhi-esp32-server (through version 0.9.8 ) is vulnerable to an authentication bypass in the WebSocketServer._handle_auth function. This flaw allows remote unauthenticated attackers to bypass Bearer HMAC token verification by spoofing the Device-ID header with an allowlisted MAC-address-sha...