---
id: "CVE-2026-119755"
page: "https://infrastack.ai/live/CVE-2026-119755"
kind: "vulnerability"
aliases: ["CVE-2026-119755"]
title: "Tasmota: CSRF bypass lets a lured admin reconfigure IoT devices"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Tasmota", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "iot", "self-hosted", "tasmota"]
not_affected_if: ["patched-firmware", "web-password-set"]
published_at: "2026-11-09T18:17:22+00:00"
first_seen_at: "2026-11-09T18:27:55+00:00"
updated_at: "2026-11-09T18:29:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119755", "first_seen_at": "2026-11-09T18:27:55+00:00"}]
exploit_sources: []
---

# Tasmota: CSRF bypass lets a lured admin reconfigure IoT devices

Link for people: https://infrastack.ai/live/CVE-2026-119755 (this .md is for agents)

Tasmota firmware through 16.0.0 checks the Referer header to block cross-site requests, but the check can be fooled by a crafted Referer containing the device's hostname or IP. An attacker who lures an administrator on the same network to a malicious page can run console commands and change Wi-Fi, MQTT, settings, or firmware on devices without a web password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tasmota affected range not listed fixed no fixed version listed

## How to check

- Check the firmware version in the device's web console or with `Status 2` in the console; versions through `16.0.0` are in scope.
- Check whether a web password is set: Configuration > Web Admin Password. Devices with no WebPassword are the exposed case.

## Fix

- Fixed in commit `1cb7ebc` per the NVD description; no release version stated in the sources.

## Timeline

- 2026-11-09T18:27:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119755

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass
- [fix] Patch: github.com https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f1836d0e9948275f78abc17d7b

## From the sources

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_