Live › vulnerability › CVE-2026-119703
xiaozhi-esp32-server, a voice-assistant backend for ESP32 devices, skips Bearer HMAC token checks when a request carries an allowlisted device ID in its Device-ID header. A remote attacker who spoofs that header can open an authenticated WebSocket session, issue voice commands, exchange audio and read that device's conversation context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Self-hosted xiaozhi-esp32-server deployments (through 0.9.8) that are reachable over the network and have turned on server.auth.enabled together with an allowed_devices list. An attacker who knows or guesses a listed device MAC can open a WebSocket as that device, speak to the assistant and read its conversation context. Deployments with auth disabled (the shipped default), an empty allowlist, or no network exposure can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| xiaozhi-esp32-server | github | <= 0.9.8 | – |
v0.9.8 is affected)v0.9.8Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.
This page as .md · .json · in your agent: get_signal("CVE-2026-119703")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.