CVE-2026-71264 PUBLISHED

WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

Assigner: TuranSec
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 05.08.2026

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean correctPIN (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
CVSS Score: 8.2

Product Status

Vendor Aircoookie
Product WLED
Versions Default: unaffected
  • affected from 0 to * (incl.)

Credits

  • Alibek Baxtiyorov finder

References

Problem Types

  • CWE-862 CWE