Authentication bypass in Xiaozhi ESP32 server Java via OTA endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.
Summary
Xiaozhi-esp32-server-java through 6.1.0 by joey-zhou contains an authentication bypass that lets unauthenticated remote attackers obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM, STT and TTS credentials, and overwrite device metadata. Public proof-of-concept exploit code is noted in CISA SSVC data, but the flaw is not in CISA KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for xiaozhi-esp32-server-java.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111623
- 2026-10-16 Alias added: GHSA-g79m-4gpq-p8x3
- 2026-10-18 Priority changed: MEDIUM → LOW
- 2026-10-23 CISA SSVC decision points changed
- 2026-10-23 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceAppService.java#L298-L346
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceController.java#L142-L153
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-common/src/main/java/com/xiaozhi/communication/auth/DeviceAuthService.java#L76-L81
- https://github.com/joey-zhou/xiaozhi-esp32-server-java
More joey-zhou vulnerabilities
- TI-2025-13813 Improper authentication in joey-zhou xiaozhi-esp32-server-java CVSS 4.0MEDIUM 5.3
- TI-2025-02966 joey-zhou xiaozhi-esp32-server-java update sql injection CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-111623 · CVE Program
- CVE-2026-111623 · NVD
- FIRST EPSS
- GHSA-g79m-4gpq-p8x3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences