CVE-2026-42855 arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack
Attackers can bypass per-resource access control in ESP32 WebServer by replaying digest authentication headers for different URIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42855?
CVE-2026-42855 is a high-severity authentication bypass vulnerability in espressif arduino-esp32, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.
Weakness: CWE-287
Which versions are affected by CVE-2026-42855?
It affects 1 product.
Products include Espressif Arduino-Esp32.
How do I fix CVE-2026-42855?
No fix has been published for CVE-2026-42855 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-42855 being exploited?
There is no known exploitation of CVE-2026-42855 in the wild and no public exploit code.
Other vulnerabilities in espressif arduino-esp32
Sources
Also known as GHSA-28hv-fwm3-rpcq.