CVE-2026-111623: Authentication Bypass by Spoofing in joey-zhou xiaozhi-esp32-server-java

CVE-2026-111623 describes an authentication bypass vulnerability in joey-zhou's xiaozhi-esp32-server-java up to version 6.1.0. The vulnerability arises because the /api/device/ota endpoint does not properly verify the authenticity of MAC address requests, allowing attackers to obtain valid WebSocket tokens without authentication. With these tokens, attackers can access the device's WebSocket channel to read sensitive role system prompts, alter conversation history, misuse LLM/STT/TTS credentials, and overwrite device metadata.

An unauthenticated attacker can bypass authentication controls to obtain valid WebSocket tokens, enabling unauthorized access to device communication channels. This can lead to disclosure of private system prompts, unauthorized modification of conversation history, misuse of language and speech processing credentials, and alteration of device metadata. The CVSS 4.0 score of 6.3 reflects a medium severity impact with network attack vector and partial confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/device/ota endpoint and monitor for suspicious requests involving MAC address spoofing. Implement additional authentication or validation controls on WebSocket token issuance if possible.