Authentication Bypass in Xiaozhi ESP32 Server by Xinnan Tech

CVE-2026-119703

What is CVE-2026-119703?

The Xiaozhi ESP32 Server version up to 0.9.8 has an identified vulnerability that allows unauthorized access due to improper authentication processes in the WebSocket server. By exploiting this weakness, an attacker can bypass Bearer HMAC token verification by spoofing the Device-ID header. This results in the ability to gain unauthorized access to an authenticated WebSocket session, where malicious actors can issue commands for voice assistants, exchange audio data, and even access device conversation context, posing significant security risks.

References