{"uuid": "f543a361-55fc-4dd0-93f4-ace624c789f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-rrxg-g2pf-6hh4", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117270781388053699", "content": "WTF?\nhttps://github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4\n\nThe dashboard reads its authentication credentials from $ESPHOME_USERNAME and $ESPHOME_PASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who had protected their dashboard with USERNAME / PASSWORD (as the older getting started guide documented) loses authentication on upgrade and the dashboard starts open to anyone who can reach its port.", "creation_timestamp": "2026-09-14T18:21:58.184872Z"}