Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: xinnan-tech Clear all filters
TI-2026-83178 CVE-2026-119703 · GHSA-wv6h-fhj6-j53g

Authentication bypass in xiaozhi-esp32-server via Device-ID spoofing

Priority MEDIUM 61

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Devic…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0034 Published 2026-10-30 No fix listed CWE-290
TI-2026-80086 CVE-2026-116017 · GHSA-2hv3-q586-pf3c

Authorization bypass in Xiaozhi-esp32-server exposes device address books

Priority LOW 23

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00228 Published 2026-10-24 Fixed in 0.9.8 CWE-639