{"id":"CVE-2026-119703","title":"xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header","summary":"xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Atta…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-290"],"vendor":"xinnan-tech","product":"xiaozhi-esp32-server","affected":["xiaozhi-esp32-server <= 0.9.8"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T22:48:52.705799Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:49:15.168Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119703","references":[{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448","label":"GitHub Issue #3448"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457"},{"url":"https://www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-header","label":"VulnCheck Advisory: xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header"}],"tags":["cve.org","exploit-available"],"epss":0.0034,"epssPercentile":0.27594,"ingestedAt":"2026-11-05T21:36:00.660Z","slug":"CVE-2026-119703","body":"## Overview\n\nxiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.\n\n## Affected\n\n- `xiaozhi-esp32-server <= 0.9.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}