ESPHome Vulnerability Allows Unauthorized Access to Smart Devices
A critical authentication bypass vulnerability has been identified in the ESPHome ESP-IDF web server component, allowing unauthorized network users to access smart devices without valid credentials.
A critical authentication bypass vulnerability has been identified in the ESPHome ESP-IDF web server component, allowing unauthorized network users to access smart devices without valid credentials.
The flaw, known as CVE-2025-57808, was reported by security researcher jesserockz. It affects Basic Authentication in ESPHome by accepting empty or partially correct Authorization headers, compromising security.
Users of ESPHome version 2025.8.0 are advised to update to version 2025.8.1 to address this issue.
The vulnerability arises from incorrect validation of client credentials in the ESP-IDF platform. The server improperly compares only the initial bytes of the supplied string against the expected value, allowing unauthorized access if the supplied fragment matches the legitimate credential prefix.
An empty Authorization value can bypass the check, granting attackers access to protected endpoints.
The following ESPHome configuration was used to demonstrate the flaw:
esp32: board: ... framework: type: esp-idf web_server: auth: username: user password: somereallylongpass
The flaw, known as CVE-2025-57808, was reported by security researcher jesserockz.
Access with correct credentials is successful, but attackers can gain entry by submitting a substring of the password, such as somereally , some , or s .
The vulnerability is rooted in the implementation of AsyncWebServerRequest::authenticate , which truncates comparison based on the provided header length.
A simple curl command can exploit the vulnerability:
$ curl -D- http://example.local/ HTTP/1.1 401 Unauthorized …
$ curl -D- -H 'Authorization: Basic ' http://example.local/ HTTP/1.1 200 OK …
This high-severity vulnerability affects any ESPHome-powered device running on ESP-IDF with the web_server component enabled. Attackers with local network access can:
Trigger over-the-air (OTA) firmware updates, potentially installing malicious firmware. Access device configuration and status pages, revealing sensitive information. Manipulate device settings or trigger actions without user consent.
ESPHome maintainers have released version 2025.8.1, correcting the authentication logic. Users should upgrade to this version immediately.
Disable the web_server component on all ESP-IDF-based ESPHome devices. Restrict network access to trusted hosts using VLANs or firewall rules. Disable OTA updates via the web server and consider alternative update mechanisms.
Discovery : Reported by jesserockz on GitHub Security Advisory GHSA-mxh2-ccgj-8635. Affected Versions : ESPHome 2025.8.0. Patched Versions : ESPHome 2025.8.1. CVE ID : CVE-2025-57808. CVSS v3.1 Base Score : 7.3 (High) [AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N].
Implementing the patch is the only guaranteed remedy. Smart home operators should apply updates promptly and enforce network security best practices.
Based on reporting by GBHackers.