{"schema":"threatline.record/2","record":{"id":"CVE-2026-111623","aliases":[],"summary":"Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance","details":"Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.","categories":["Unclassified"],"product":"xiaozhi-esp32-server-java","vendor":"joey-zhou","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111623","source_modified_at":"2026-10-23T18:36:30.866Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"xiaozhi-esp32-server-java","vendor":"joey-zhou","versions":[{"version":"0","lessThanOrEqual":"6.1.0","status":"affected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00364,"percentile":0.29112,"score_date":"2026-10-23"},"published_at":"2026-10-16T17:38:59.425Z","modified_at":"2026-10-23T18:36:30.866Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111623","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T18:36:30.866Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111623","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-java-ota-device-token-issuance","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceAppService.java#L298-L346","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-server/src/main/java/com/xiaozhi/device/DeviceController.java#L142-L153","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java/blob/v6.1.0/xiaozhi-common/src/main/java/com/xiaozhi/communication/auth/DeviceAuthService.java#L76-L81","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/joey-zhou/xiaozhi-esp32-server-java","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/xiaozhi-esp32-server-java-through-6.1.0-authentication-bypass-via-ota-endpoint-token-issuance","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T18:36:22.538834Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T18:36:30.866Z","content_hash":"d9967853390dbe82ba6121828c6524a27997e16fbe35846e99f9c781720d8af6"}}