What happened
CVE-2026-111623 (CVSS 5.6, CWE-290, published 2026-10-16 by VulnCheck, verified via NVD REST): the OTA endpoint issues valid device WebSocket tokens for any supplied MAC without authentication, allowing takeover of the device's AI conversation channel and consumption of LLM/STT/TTS credentials.
Why it matters
A precise instance of auth-bypass in the AI voice-assistant backend: the attacker can impersonate the device, read the role prompt that steers the AI, poison conversation history, and burn the operator's speech/LLM API credentials — all without any authentication.
Attack vector
Unauthenticated GET to /api/device/ota with any MAC address returns a valid device WebSocket token; with it an attacker can open a victim device's channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.
Affected systems
xiaozhi-esp32-server-java ≤ 6.1.0 (joey-zhou)
Mitigation
Upgrade beyond 6.1.0; restrict access to the OTA/token-issuance endpoint. See VulnCheck advisory.