CVE-2025-57808 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
Attackers can bypass authentication in ESPHome's web server by sending empty or partial Authorization headers, gaining unauthorized access to functionality including OTA updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57808?
CVE-2025-57808 is a high-severity authentication bypass vulnerability in esphome, published on 2 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
Weakness: CWE-303
Which versions are affected by CVE-2025-57808?
3 open source packages ship an affected version, including esphome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
esphome PyPI | All versions | 2025.8.1 |
esphome PyPI | All versions | 2025.8.1 |
esphome PyPI | All versions | 2025.8.1 |
Products include Esphome Esphome Firmware.
How do I fix CVE-2025-57808?
Upgrade esphome to 2025.8.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-57808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57808 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in esphome
Sources
Also known as GHSA-mxh2-ccgj-8635, PYSEC-2026-1330.