Cross-Site Request Forgery Vulnerability in Tasmota IoT Software by Sonoff
CVE-2026-119755

7.5HIGH

Key Information:

Vendor

Arendst

Status
Tasmota
Vendor
CVE Published:
9 November 2026

What is CVE-2026-119755?

Tasmota versions up to 16.0.0 exhibit a vulnerability that allows cross-site request forgery (CSRF) attacks, enabling unprivileged attackers to bypass Referer-based protections. By exploiting a crafted Referer header, attackers can pose as legitimate users, potentially executing arbitrary commands on devices or altering critical settings such as Wi-Fi and MQTT configurations. The flaw particularly affects devices that do not have a WebPassword set, making them susceptible to unauthorized access.

Affected Version(s)

Tasmota 0 <= 16.0.0

Tasmota 1cb7ebcafb0b79f1836d0e9948275f78abc17d7b

References

https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f...
patchissue-tracking
https://www.vulncheck.com/advisories/tasmota-csrf-via-ref...
third-party-advisory

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdurakhmonov Ulugbek
.