CVE-2026-71264: WLED Auth Bypass Vulnerability

CVE-2026-71264 Overview

CVE-2026-71264 is a missing authorization vulnerability [CWE-862] in WLED, an open-source ESP8266/ESP32 LED controller firmware. The GET /json/cfg endpoint in wled00/wled_server.cpp calls serveJson() without a settings-PIN check, exposing network, hardware, and LED configuration to any unauthenticated client on the network. A separate flaw tracks the settings-PIN unlock state through a single global boolean correctPIN in wled00/wled.h instead of per-session state. Once any client submits the correct 4-digit PIN, every subsequent client gains full configuration-write access until reboot.

Critical Impact
Unauthenticated attackers on the same network can read device configuration and, after any legitimate PIN unlock, push OTA firmware, reconfigure WiFi, or trigger a factory reset.

Affected Products

WLED firmware (Aircoookie/WLED)
Deployments exposing the WLED HTTP interface on ESP8266 and ESP32 devices
Any WLED build using the vulnerable wled00/wled_server.cpp and wled00/wled.h PIN handling

Discovery Timeline

2026-08-05 - CVE-2026-71264 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71264

Vulnerability Analysis

WLED exposes an HTTP JSON API for device configuration and control. The /edit endpoint enforces authorization by checking the correctPIN flag before serving content. The GET /json/cfg handler, registered in wled00/wled_server.cpp, omits that check and invokes serveJson() directly. Any unauthenticated client with network reachability retrieves the full configuration document, including network settings, hardware pin mappings, and LED topology.

The second defect concerns how WLED represents authenticated state. Instead of binding PIN validation to a session token, cookie, or client identity, the firmware stores a single process-wide boolean correctPIN. A successful POST /json submission that includes the correct 4-digit PIN sets this flag globally. All subsequent requests from any client bypass PIN enforcement until the device reboots or the state resets.

Root Cause

Two distinct design flaws combine. The first is a missing authorization check on a sensitive read endpoint. The second is coarse global session tracking. A 4-digit PIN also yields only 10,000 possible values, which is trivially brute-forceable over an unrestricted HTTP API.

Attack Vector

An attacker on the same layer-2 or routable network sends GET /json/cfg and receives the device configuration without credentials. To gain write access, the attacker waits for or induces a legitimate PIN entry, or brute-forces the 4-digit PIN by iterating POST /json requests. Once correctPIN is true, the attacker performs OTA firmware upload, WiFi reconfiguration, or factory reset through the standard JSON API.

Refer to the WLED server source for the affected handler registration.

Detection Methods for CVE-2026-71264

Indicators of Compromise

Unexpected GET /json/cfg requests from hosts that do not normally interact with WLED devices.
POST /json traffic containing repeated PIN field submissions, indicating brute-force attempts.
Unscheduled OTA firmware uploads or WiFi SSID changes on WLED devices.
Device reboots followed by loss of configured presets or altered network settings.

Detection Strategies

Inspect HTTP access logs on network gateways for /json/cfg and /json requests to WLED device IP addresses.
Alert on high-volume POST /json traffic to a single WLED endpoint from one source within a short window.
Baseline expected firmware versions and flag unexpected OTA-triggered version changes.

Monitoring Recommendations

Place WLED and similar IoT devices on a segmented VLAN with logged traffic.
Capture DHCP and ARP telemetry to correlate device identity with configuration API access.
Track outbound connections from WLED devices for signs of post-compromise beaconing after firmware tampering.

How to Mitigate CVE-2026-71264

Immediate Actions Required

Restrict network access to WLED devices using firewall rules or VLAN isolation so only trusted management hosts reach the HTTP interface.
Change the settings PIN and reboot the device to clear any lingering correctPIN state.
Disable remote OTA updates where the deployment does not require them.
Audit WLED devices for unexpected firmware versions, WiFi settings, and configuration changes.

Patch Information

No fixed version is listed in the NVD entry at publication. Monitor the WLED GitHub project for a release that enforces authorization on /json/cfg and replaces the global correctPIN boolean with per-session state.

Workarounds

Block inbound HTTP to WLED devices from untrusted network segments at the router or switch.
Require a VPN or bastion host for any administrative interaction with WLED devices.
Reboot WLED devices on a schedule to reset the global PIN unlock flag when legitimate administrative sessions end.
Avoid deploying WLED on networks shared with guest, IoT, or untrusted wireless clients.

bash

# Example iptables rule limiting WLED HTTP access to a management host
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.25 --dport 80 -j DROP