ESPHome versions through 2026.7.0-dev have a vulnerability in the web_server component that discloses plaintext passwords. The web_server listens on port 80 without authentication by default, allowing local network attackers to retrieve sensitive information such as WiFi credentials and API tokens via specific HTTP endpoints. The issue arises because the JSON serialization exposes the raw password in the "value" field despite masking it in the "state" field.