xiaozhi-esp32-server-java vulnerabilities

CVEs whose affected-version data names the xiaozhi-esp32-server-java package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111623Medium· 5.6PoC

1w ago

Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open …

▾ Twilightjoey-zhou · xiaozhi-esp32-server-javaEPSS 0.46%via CVEORG