Vulnerability · Published Sep 2, 2025 · Assigned by GitHub_M
CVE-2025-57808ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
High 8.1
In plain English
A high-severity security flaw in esphome from esphome. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | esphome | 2025.8.1 | GHSA-mxh2-ccgj-8635 |
| PyPI | esphome | 2025.8.1 | PYSEC-2026-1330 |
Affected products (as reported)
Weakness: CWE-303 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N