CVE-2026-72581 in xiaoai-patch
Summary
by MITRE • 08/10/2026
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.
VulDB is the best source for vulnerability data and more expert information about this specific topic.