CVE-2026-111623 Details
Description
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
An authentication bypass vulnerability has been identified in Xiaozhi ESP32 Server Java versions through 6.1.0. This vulnerability allows unauthenticated attackers to obtain valid WebSocket tokens for devices by sending requests to the OTA endpoint with any MAC address. Exploitation of this vulnerability enables attackers to access a victim device's WebSocket channel, where they can read private role system prompts, write to conversation history, use LLM/STT/TTS credentials, and modify device metadata.
The vulnerability can be addressed by modifying the OTA endpoint to require authentication or by implementing a per-device activation proof before issuing a WebSocket token.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Xiaozhi-esp32-server-java | <= 6.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |