---
id: CVE-2026-119703
title: >-
  xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID
  Header
summary: >-
  xiaozhi-esp32-server through 0.9.8 contains an authentication bypass
  vulnerability in WebSocketServer._handle_auth that allows remote
  unauthenticated attackers to skip Bearer HMAC token verification by spoofing
  the Device-ID header. Atta…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-290
vendor: xinnan-tech
product: xiaozhi-esp32-server
affected:
  - xiaozhi-esp32-server <= 0.9.8
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:48:52.705799Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:49:15.168Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119703'
references:
  - url: 'https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448'
    label: 'GitHub Issue #3448'
  - url: 'https://github.com/xinnan-tech/xiaozhi-esp32-server'
  - url: >-
      https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232
  - url: 'https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457'
  - url: >-
      https://www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-header
    label: >-
      VulnCheck Advisory: xiaozhi-esp32-server through 0.9.8 Authentication
      Bypass via Spoofed Device-ID Header
tags:
  - cve.org
  - exploit-available
epss: 0.0034
epssPercentile: 0.27594
ingestedAt: '2026-11-05T21:36:00.660Z'
---

## Overview

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.

## Affected

- `xiaozhi-esp32-server <= 0.9.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.