xiaozhi-esp32-server CVE-2026-119703

Exploitation requires that the server's WebSocket authentication is enabled with an allowlist (allowed_devices) configured, and that the attacker supplies a Device-ID header whose value matches a MAC-address-shaped identifier present on that allowlist - the vulnerable _handle_auth path lets allowlisted device IDs skip Bearer HMAC token verification entirely. The practical limiting factor, reflected in CVSS AC:H/AT:P, is that the attacker must know or correctly supply a valid allowlisted MAC-shaped value; MAC addresses can be guessable or discoverable but a matching allowlisted entry is still required. No prior authentication and no user interaction are needed (PR:N/UI:N), and the endpoint must be network-reachable (AV:N). The trigger beyond the spoofed Device-ID header and allowlist match is not further detailed in the available sources.

This is a genuine but moderate-priority issue, not a top-of-queue emergency. The CVSS 4.0 base score is 6.3 (Medium) with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N: network-reachable and unauthenticated (PR:N), but tempered by high attack complexity (AC:H) and a present attack requirement (AT:P) - the attacker must supply a device identifier that matches an entry on the server's allowlist, and impact is only Low to confidentiality and integrity with no availability impact. On the real-world exploitation signals the picture is quiet: the input does not list an EPSS score, there is no CISA KEV listing (so not confirmed actively exploited), and no public exploit is identified (the vendor PR ships a regression-test harness, not weaponized exploit code). The vuln.today decision label is 'this_month', consistent with a signal set that is real and patch-available but lacks evidence of active or automatable mass exploitation. The SSVC-style read aligns: exploitation is not confirmed in the wild, it is not trivially automatable (a valid allowlisted MAC must be known), and technical impact is partial rather than total. Note explicitly: no EPSS value was provided, so widespread-exploitation probability could not be weighed, and the 'Microsoft' vendor tag in the input is incorrect for this independent open-source project (see data_quality_flags).

A remote attacker who can reach the server's WebSocket endpoint opens a connection carrying a Device-ID header shaped like - and matching - an allowlisted MAC address, which causes WebSocketServer._handle_auth to skip Bearer HMAC token verification. The attacker thereby opens an authenticated voice-assistant session, issues voice commands, exchanges audio, and reads the target device's conversation context. No public exploit code is identified in the provided data (the vendor PR includes a regression test, not an exploit); the CVSS high complexity reflects the need to know a valid allowlisted MAC-shaped identifier.