CVE-2025-57808

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

• CWE-303

• https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5Patch
• https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635Exploit, Vendor Advisory
• https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635Exploit, Vendor Advisory

Published

Sep 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57802Airlink's Daemon interfaces with Docker and the Panel to pro…8.7
• CVE-2025-57803ImageMagick is free and open-source software used for editin…8.8
• CVE-2025-57804h2 is a pure-Python implementation of a HTTP/2 protocol stac…6.9
• CVE-2025-57805The Scratch Channel is a news website. In versions 1 and 1.1…8.7
• CVE-2025-57806Local Deep Research is an AI-powered research assistant for …6.9
• CVE-2025-57807ImageMagick is free and open-source software used for editin…9.8
• CVE-2025-57809XGrammar is an open-source library for efficient, flexible, …7.5
• CVE-2025-5781Information Exposure Vulnerability in Hitachi Ops Center API…5.2
• CVE-2025-57810jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-57811Craft is a platform for creating digital experiences. From v…7.2
• CVE-2025-57812CUPS is a standards-based, open-source printing system, and …3.7
• CVE-2025-57813traQ is a messenger application built for Digital Creators C…5.9