CVE-2021-41104: Basic auth bypass in esphome
Summary
CVE-2021-41104: Basic auth bypass in esphome. Affects esphome versions < 2021.9.2. Fixed in 2021.9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Esphome is a Python package available on PyPI that provides a framework for creating custom firmware for ESP8266 and ESP32 devices. It allows users to define and configure various components and functionalities for their IoT devices. One of the features provided by Esphome is the web_server, which enables OTA (Over-The-Air) updates for the devices. However, prior to version 2021.9.2, there was a vulnerability in the web_server implementation that allowed bypassing HTTP basic authentication.
Vulnerability Detail
The vulnerability (CVE-2021-41104) in Esphome's web_server component allowed anyone with web_server enabled and HTTP basic authentication configured on version 2021.9.1 or older to perform OTA updates without being prompted for the user-defined basic authentication credentials. This means that an unauthorized user could potentially gain access to the device and perform malicious actions. The vulnerability was assigned a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2026.10.0 as of 22 Oct 2026
pip install --upgrade "esphome==2026.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2021.9.2
This is the first release that contains the fix.
pip install --upgrade "esphome==2021.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable or remove the web_server component from the Esphome configuration. This can be done by modifying the configuration file and commenting out or removing the relevant lines that enable the web_server functionality. However, it is strongly advised to update to the patched version as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2021-41104) in Esphome's web_server component allowed unauthorized users to bypass HTTP basic authentication and perform OTA updates without proper authentication. To mitigate this vulnerability, it is crucial to update to version 2021.9.2 or newer of the Esphome package. Alternatively, the web_server component can be temporarily disabled or removed from the configuration. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for esphome →
FAQ
Esphome is a Python package that allows users to create custom firmware for ESP8266 and ESP32 devices, enabling them to define and configure various components and functionalities for their IoT devices.
The web_server component in Esphome enables OTA (Over-The-Air) updates for the devices. It provides a web interface that allows users to upload and install firmware updates wirelessly.
The vulnerability allows unauthorized users to bypass the HTTP basic authentication configured for the web_server component. This means that they can perform OTA updates without providing the required authentication credentials, potentially gaining unauthorized access to the device.
The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity level. This means that it has the potential to be exploited and can lead to significant security risks if not addressed.
To fix the vulnerability, it is recommended to update to version 2021.9.2 or newer of the Esphome package. This version includes a patch that addresses the authentication bypass issue in the web_server component. Updating to the latest version will ensure that OTA updates require proper authentication before being allowed.
References
Related vulnerabilities
Recent vulnerabilities recorded for esphome.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
