{"id":"CVE-2026-111623","title":"Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance","summary":"Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open …","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-290"],"vendor":"joey-zhou","product":"xiaozhi-esp32-server-java","affected":["xiaozhi-esp32-server-java <= 6.1.0"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:38:59.425Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111623","references":[{"url":"https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-java-ota-device-token-issuance"},{"url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceAppService.java#L298-L346"},{"url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceController.java#L142-L153"},{"url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-common/src/main/java/com/xiaozhi/communication/auth/DeviceAuthService.java#L76-L81"},{"url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java"},{"url":"https://www.vulncheck.com/advisories/xiaozhi-esp32-server-java-through-6.1.0-authentication-bypass-via-ota-endpoint-token-issuance","label":"VulnCheck Advisory: Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.690Z","slug":"CVE-2026-111623","body":"## Overview\n\nXiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.\n\n## Affected\n\n- `xiaozhi-esp32-server-java <= 6.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}