Safety vulnerability ID: 79204
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of the ESPHome package are vulnerable to Authentication Bypass due to improper length validation in the HTTP Basic Authentication implementation for ESP-IDF platform devices. The `AsyncWebServerRequest::authenticate` method in `web_server_idf` only compares bytes up to the length of the client-supplied base64-encoded authorization value rather than performing a full comparison against the correct credentials, allowing partial password matches or empty authorization headers to pass authentication checks.
Latest version: 2025.9.3
ESPHome is a system to configure your microcontrollers by simple yet powerful configuration files and control them remotely through Home Automation systems.
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application