CVE-2026-111623
Deferred Deferred - Pending Action

Authentication Bypass in Xiaozhi-esp32-server-java

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111623
EUVD
EUVD-2026-103045

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joey-zhou xiaozhi-esp32-server-java 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Xiaozhi-esp32-server-java through version 6.1.0. It allows unauthenticated attackers to obtain valid device WebSocket tokens by sending a request to the /api/device/ota endpoint with any MAC address. The flaw enables attackers to access sensitive functions like reading private role system prompts, writing conversation history, consuming LLM/STT/TTS credentials, and modifying device metadata.

Detection Guidance

Check if the /api/device/ota endpoint is accessible without authentication by sending a GET request with any MAC address. Example: curl -v http://<target-ip>/api/device/ota?mac=<any-mac-address>. If the endpoint returns a valid token without credentials, the system is vulnerable.

Impact Analysis

An attacker could exploit this to access your device's WebSocket channel, read private system prompts, write messages into your conversation history, use your LLM/STT/TTS provider credentials (incurring costs), and overwrite your device's metadata. This requires only knowledge of your device's MAC address, which is often publicly visible.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized data processing, and lack of user consent for data access, potentially leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade to a patched version of xiaozhi-esp32-server-java beyond 6.1.0. If upgrading is not possible, disable the OTA endpoint or restrict access to authenticated users only. Review and revoke any exposed tokens issued via the vulnerable endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart