CVE-2025-57808: ESPHome Web Server Authentication Bypass Exposes Smart Devices

CVE-2025-57808 affects the ESPHome project, a popular open-source firmware framework for ESP32- and ESP8266-based smart home devices, and is rated CVSS 8.1 (High). The flaw bypasses basic authentication in ESPHome’s web server component, allowing anyone on the same local network to access devices and potentially trigger OTA firmware updates.

The root cause lies in the AsyncWebServerRequest::authenticate function, which validates base64-encoded Authorization headers only by comparing a substring to the stored credential, meaning substrings such as dXNlcjpz or even an empty string can pass the check, according to ESPHome. Affected version is ESPHome 2025.8.0, with a fix in ESPHome 2025.8.1; until patched, disable the web server component on ESP-IDF devices, especially where OTA is active. The advisory provides demonstrations and a simple curl example showing how an attacker can obtain access without the correct username or password.