| शीर्षक | joey-zhou xiaozhi-esp32-server-java V3.0.0 Improper Authentication |
|---|
| विवरण | Xiaozhi ESP32 Server Java V3.0.0 (the latest version) contains an authentication bypass vulnerability. Attackers can exploit the access whitelist set by the developer to obtain sensitive user information and forge cookies to impersonate any user login.
Project address：https://github.com/joey-zhou/xiaozhi-esp32-server-java
Scope of impact: Several companies have been found to have deployed this service. The ICO can be used as a fingerprint for searching. |
|---|
| स्रोत | ⚠️ https://github.com/joey-zhou/xiaozhi-esp32-server-java/issues/143 |
|---|
| उपयोगकर्ता | zzdzz (UID 93061) |
|---|
| सबमिशन | 12/12/2025 08:24 AM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 10:53 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338513 [joey-zhou xiaozhi-esp32-server-java तक 3.0.0 Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|