MEDIUM 6.3 NVD
CVE-2026-111623
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket t
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
References
- https://github.com/joey-zhou/xiaozhi-esp32-server-java
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-common/src/main
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main
- https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main
- https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-java-ota-device-token-issuance
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.