Missing Authentication for Critical Function Affecting esphome-device-builder package, versions [,1.0.12)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authentication for Critical Function vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-ESPHOMEDEVICEBUILDER-20158943
- published27 Sept 2026
- disclosed14 Sept 2026
- creditUnknown
Introduced: 14 Sep 2026
NewCVE-2026-59178 (opens in a new tab)How to fix?
Upgrade esphome-device-builder to version 1.0.12 or higher.
Overview
esphome-device-builder is an ESPHome Device Builder
Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the DashboardSettings.parse_args process when only legacy environment variables are set. An attacker can gain unauthorized access to the dashboard and perform actions such as managing devices, editing configurations, and flashing firmware by connecting to the dashboard port without credentials. This is only exploitable if the deployment relies solely on the legacy $USERNAME and $PASSWORD environment variables for authentication, and does not use the updated environment variables, command-line arguments, or Home Assistant add-on ingress.
Workaround
This vulnerability can be mitigated by setting the ESPHOME_USERNAME and ESPHOME_PASSWORD environment variables to the desired credentials, or by restricting dashboard port exposure to trusted networks and monitoring startup logs for authentication status.