The ESPHome Device Builder Dashboard is vulnerable to an authentication bypass flaw that permits unauthenticated remote access to the dashboard interface, posing a critical risk of full system compromise.

This vulnerability is a missing authentication for critical function (CWE-306) caused by a failure to correctly parse environment variables for credential validation. Attackers can access the dashboard without authentication if the deployment relies on legacy environment variable naming conventions.

The vulnerability carries a CVSS score of 9.8, reflecting the ability for an unauthenticated remote attacker to gain full control over the home management dashboard. Successful exploitation permits unauthorized access to sensitive configuration data and potentially allows for the execution of arbitrary commands or device manipulation, leading to severe operational disruption or loss of privacy.

Immediate Action: Upgrade the ESPHome device-builder component to version 1.0.12 or later immediately to restore authentication fallback logic. If an immediate update is not possible, manually define the $ESPHOME_USERNAME and $ESPHOME_PASSWORD environment variables in the deployment configuration to ensure access control is enforced.

Proactive Monitoring: Review application startup logs for the "WITHOUT AUTHENTICATION" warning banner, which indicates the instance is currently exposed. Monitor network traffic for unauthorized access attempts directed at the dashboard port.

Compensating Controls: Restrict network access to the dashboard port using host-based firewalls or network access control lists (ACLs) to ensure the service is not reachable from untrusted networks.

Public Exploit Available: No

Given the critical severity of this authentication bypass, administrators must prioritize updating to version 1.0.12. This update reintroduces support for legacy credentials while providing clear guidance for migration, ensuring that systems remain protected against unauthorized access.