EUVD lists auth bypass in xiaozhi-esp32-server through 0.9.8 (EUVD-2026-114108)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- xinnan-tech
- Product
- xiaozhi-esp32-server
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114108, as shared on Mastodon, describes an authentication bypass in xiaozhi-esp32-server through 0.9.8. The entry scores it 6.3/10 (CVSS v3.1) and says remote unauthenticated attackers can skip Bearer HMAC token checks by spoofing the Device-ID header.
If you use xinnan-tech
Check whether you run xiaozhi-esp32-server 0.9.8 or earlier.
Restrict network access to the WebSocket server until a fix is available.
Apply the vendor's patched release when published and rotate any device tokens.
What the sources say 1
· Mastodon: “xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header.” Source