{"id":"CVE-2026-119703","aliases":[],"cve":{"records":[{"id":"CVE-2026-119703","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T14:49:22.241Z","published":"2026-10-30T15:16:03.996Z","modified":"2026-10-30T15:19:20.269Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T15:19:20.269Z"}],"references":[{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457","tags":["patch","issue-tracking"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-header","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-290","description":"Authentication Bypass by Spoofing","source":"VulnCheck"}],"applicability":[],"prioritization":[]},"title":"xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.","score":6.3,"severity":"medium","published":"2026-10-30T15:16:03.996Z","modified":"2026-10-30T15:19:20.269Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"xinnan-tech","name":"xiaozhi-esp32-server","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.9.8","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119703"}],"remediation":[],"references":["https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3448","https://github.com/xinnan-tech/xiaozhi-esp32-server","https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.8/main/xiaozhi-server/core/websocket_server.py#L211-L232","https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3457","https://www.vulncheck.com/advisories/xiaozhi-esp32-server-through-0.9.8-authentication-bypass-via-spoofed-device-id-header"],"sources":[{"name":"CVE","id":"CVE-2026-119703","modified":"2026-10-30T15:19:20.269Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119703"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"sourceAffected":[],"observedAt":"2026-10-30T17:04:05.666Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}