https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-01T19:35:20.688048+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-119703 CVE-2026-119703 — xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header 2026-11-01T19:35:20.689431+00:00

Affected: xinnan-tech xiaozhi-esp32-server

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device identifier can open an authenticated WebSocket session, issue voice-assistant commands, exchange audio, and read that device's conversation context.