Tasmota: Cross-site request forgery via Referer header bypass (CVE-2026-119755)
Tasmota through 16.0.0 contains a cross-site request forgery vulnerability in HttpCheckPriviledgedAccess() allowing Referer-based protection bypass.
CVE search metadata
CVE search record: CVE-2026-119755. Severity: high. CVSS: 7.5. KEV: no. Product: Tasmota (<= 16.0.0). Brief: Tasmota: Cross-site request forgery via Referer header bypass (CVE-2026-119755). Brief link: https://feed.craftedsignal.io/briefs/2026-11-tasmota-csrf/
Triage facts
Revision 1- Applicability
- Tasmota (<= 16.0.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 19:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword. The CVSS v3.1 base score is 7.5.