CVE-2025-15135

MediumCVSS 6.3

Published: 28/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to version 3.0.0. The tryAuthenticateWithCookies function in the AuthenticationInterceptor.java file of the Cookie Handler component is affected by improper authentication. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version 4.0.0 fixes this issue.

Risk Assessment

A remote attacker can bypass authentication mechanisms, gaining unauthorized access to the system and data.

Recommendation

Upgrade the component to version 4.0.0 or later as soon as possible, as it contains the fix.

Other vulnerabilities in xiaozhi-esp32-server-java

CVE-2026-111623Medium
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata.

Original NVD description (English source)

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 4.0.0 will fix this issue. It is recommended to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS