{"id":"CVE-2026-119703","kind":"vulnerability","aliases":["CVE-2026-119703"],"related":[],"title":"xiaozhi-esp32-server: WebSocket auth bypass lets attackers impersonate devices","description":"xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.","summary":"xiaozhi-esp32-server, a voice-assistant backend for ESP32 devices, skips Bearer HMAC token checks when a request carries an allowlisted device ID in its Device-ID header. A remote attacker who spoofs that header can open an authenticated WebSocket session, issue voice commands, exchange audio and read that device's conversation context.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"xiaozhi-esp32-server","fixed":[],"affected":"<= 0.9.8","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","esp32","self-hosted","websocket","xiaozhi-esp32-server"],"not_affected_if":["auth-disabled","default-config","empty-allowlist","not-internet-exposed","unknown"],"how_to_check":"In xiaozhi-server config (config.yaml / manager-api parameters), check server.auth.enabled: true together with a non-empty server.auth.allowed_devices list. If both are set, any client sending a Device-ID header equal to a listed MAC skips Bearer token verification. If auth is disabled or allowed_devices is empty, this path is not used.","fix":"No released fix found as of 2026-10-30 (latest v0.9.8 is affected). Fix PR #3457 is referenced in issue #3448; watch for a release after v0.9.8. Interim: empty allowed_devices so every device must present a Bearer token, per the issue thread.","status":"open","published_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:23+00:00","updated_at":"2026-10-30T16:34:33+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-30T16:32:23Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"xiaozhi-esp32-server: WebSocket auth bypass lets attackers impersonate devices","impact":"medium","summary":"xiaozhi-esp32-server, a voice-assistant backend for ESP32 devices, skips Bearer HMAC token checks when a request carries an allowlisted device ID in its Device-ID header. A remote attacker who spoofs that header can open an authenticated WebSocket session, issue voice commands, exchange audio and read that device's conversation context.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["xiaozhi-esp32-server","esp32","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker drives device sessions and reads conversation context","analyst_note":"Check the NVD entry and the project repository for the fixed version, the default allowlist behaviour, and whether a patch exists.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any deployment of xiaozhi-esp32-server through 0.9.8 reachable over the network is in scope, since the bypass needs only a crafted Device-ID header and an allowlisted device identifier. The sources do not say whether default configurations enable the vulnerable allowlist path, so the team should confirm that against its own setup.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4193,"output_tokens":536,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Check the NVD entry and the project repository for the fixed version, the default allowlist behaviour, and whether a patch exists.","search":"'-119703':14A,17A '-2026':13A,16A '0.9.8':95C 'address':127C 'ai':23B 'ai-tool':22B 'allow':104C 'allowlist':56B,124C 'assist':41B,140C 'attack':9A,67B,107C,121C 'audio':82B,143C 'auth':6A 'authent':75B,98C,134C 'backend':42B 'bearer':47B,110C 'bypass':7A,99C 'carri':54B 'check':50B 'command':80B,141C 'contain':96C 'context':89B,150C 'convers':88B,149C 'cve':12A,15A 'devic':11A,45B,57B,62B,86B,118C,129C,147C 'device-id':61B,117C 'esp32':3A,20A,25B,32B,36B,44B,92C 'exchang':81B,142C 'header':64B,71B,120C 'hmac':48B,111C 'host':28B 'id':58B,63B,119C 'identifi':130C 'imperson':10A 'issu':78B,137C 'let':8A 'mac':126C 'mac-address-shap':125C 'open':73B,132C 'read':84B,145C 'remot':66B,105C 'request':53B 'self':27B 'self-host':26B 'server':4A,21A,33B,37B,93C 'session':77B,136C 'shape':128C 'skip':46B,109C 'spoof':69B,115C 'suppli':122C 'token':49B,112C 'tool':24B 'unauthent':106C 'verif':113C 'voic':40B,79B,139C 'voice-assist':39B,138C 'vulner':100C 'websocket':5A,29B,76B,135C 'websocketserver._handle_auth':102C 'xiaozhi':2A,19A,31B,35B,91C 'xiaozhi-esp32-server':1A,18A,30B,34B,90C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted xiaozhi-esp32-server deployments (through 0.9.8) that are reachable over the network and have turned on server.auth.enabled together with an allowed_devices list. An attacker who knows or guesses a listed device MAC can open a WebSocket as that device, speak to the assistant and read its conversation context. Deployments with auth disabled (the shipped default), an empty allowlist, or no network exposure can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119703","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119703","severity":null,"published_at":"2026-10-30T16:17:51+00:00","modified_at":"2026-10-30T16:17:51+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119703:1172","url":null,"severity":null,"published_at":"2026-10-30T16:34:33+00:00","modified_at":"2026-10-30T16:34:33+00:00","first_seen_at":"2026-10-30T16:34:33+00:00","fetched_at":"2026-10-30T16:34:33+00:00","note":"Maintainer-repo issue #3448 (confirmed by contributor on main) read; vulnerable only when server.auth.enabled=true AND allowed_devices non-empty (shipped default enabled:false). No released fix: v0.9.8 notes do not mention it; fix PR #3457 referenced, merge status not confirmed. Not marked verified: how-to-check and who_affected come from an issue thread, not a vendor advisory."}],"documents":[{"id":24668,"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448","title":"Device authentication allowlist can be bypassed by spoofing the Device-ID header (#3448)","kind":"issue","source":"analyst","publisher":null,"text":"Open issue by carfeii. Applies when server.auth.enabled: true and allowed_devices is non-empty: _handle_auth in core/websocket_server.py returns without token check if client-supplied Device-ID header is in allowed_devices. Same pattern in core/api/ota_handler.py. Confirmed on commit eb9dc8c; contributor shinjiyu confirmed on main. Fix PR #3457 (Fixes #3448) in progress; interim: leave allowed_devices empty and force Bearer token.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24669,"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/releases","title":"xiaozhi-esp32-server releases (v0.9.8, 23 Oct 2026)","kind":"release","source":"analyst","publisher":null,"text":"v0.9.8 notes list address-book IDOR fix, edge-tts, TTS fixes; no mention of the Device-ID allowlist bypass.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}