https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T01:26:40.766860+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-57808 CVE-2025-57808 — ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header 2026-10-08T01:26:40.794417+00:00

Affected: esphome

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.