CVE-2026-119755: Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Q: Which devices are exposed to this attack?

Tasmota devices through 16.0.0 that do not have a WebPassword configured are exposed. Exploitation also requires an administrator to visit an attacker-controlled page while on the device's network.

Q: What does an attacker need to do to exploit the issue?

The attacker must lure an administrator to a malicious page that sends requests with a crafted Referer header. The Referer places the device hostname or IP as a substring immediately after http://.evil.com/ to bypass the Referer-based check.

Q: What could a successful attack allow?

A successful CSRF attack can issue arbitrary console commands and change Wi-Fi, MQTT, device settings, or firmware configuration. The resulting impact can affect confidentiality, integrity, and availability.

Q: What mitigation is available if updating is not immediately possible?

Configure a WebPassword on affected devices, since the described attack targets devices lacking one. Administrators should also avoid opening untrusted pages while connected to the device network.

Q: How can I determine whether a device needs remediation?

Check whether the device runs Tasmota 16.0.0 or an earlier release and whether a WebPassword is absent. The issue is fixed by commit 1cb7ebc.

Published Nov 9, 2026

Updated

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.

Affected Software

1 affected component

Tasmota Tasmota<=16.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tasmota to a version that resolves this vulnerability.
Patch 1cb7ebc

Event History

Nov 9, 2026

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which devices are exposed to this attack?

Tasmota devices through 16.0.0 that do not have a WebPassword configured are exposed. Exploitation also requires an administrator to visit an attacker-controlled page while on the device's network.

What does an attacker need to do to exploit the issue?

The attacker must lure an administrator to a malicious page that sends requests with a crafted Referer header. The Referer places the device hostname or IP as a substring immediately after http://.evil.com/ to bypass the Referer-based check.

What could a successful attack allow?

A successful CSRF attack can issue arbitrary console commands and change Wi-Fi, MQTT, device settings, or firmware configuration. The resulting impact can affect confidentiality, integrity, and availability.

What mitigation is available if updating is not immediately possible?

Configure a WebPassword on affected devices, since the described attack targets devices lacking one. Administrators should also avoid opening untrusted pages while connected to the device network.

How can I determine whether a device needs remediation?

Check whether the device runs Tasmota 16.0.0 or an earlier release and whether a WebPassword is absent. The issue is fixed by commit 1cb7ebc.

CVE-2026-119755: Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Which devices are exposed to this attack?

What does an attacker need to do to exploit the issue?

What could a successful attack allow?

What mitigation is available if updating is not immediately possible?

How can I determine whether a device needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which devices are exposed to this attack?

What does an attacker need to do to exploit the issue?

What could a successful attack allow?

What mitigation is available if updating is not immediately possible?

How can I determine whether a device needs remediation?