Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119703xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

Medium 4.8

In plain English

A medium-severity authentication bypass by spoofing in xiaozhi-esp32-server from xinnan-tech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.3%top 72.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.

Affected products (as reported)

Vendor	Product	Versions
xinnan-tech	xiaozhi-esp32-server	0 – through 0.9.8

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

GitHub Issue #3448 issue-tracking
https://github.com/xinnan-tech/xiaozhi-esp32-server product
https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232 technical-description
https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457 patch, issue-tracking
VulnCheck Advisory: xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header third-party-advisory