CVE-2026-119703 xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119703?
CVE-2026-119703 is a medium-severity vulnerability in xinnan-tech xiaozhi-esp32-server, published on 30 Oct 2026.
Official description
xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.
Weakness: CWE-290
Which versions are affected by CVE-2026-119703?
How do I fix CVE-2026-119703?
No fix has been published for CVE-2026-119703 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119703 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119703 exists.
Sources
Also known as GHSA-wv6h-fhj6-j53g.