CVE-2026-71264: WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State
WLED's GET /json/cfg endpoint (registered in wled00/wledserver.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean correctPIN (wled00/wled.h), not per-session state: once any single client submits the correct 4-digit PIN via POST /json, correctPIN becomes true for every client, granting all subsequent unauthenticated clients full configuration-write access (OTA firmware updates, WiFi reconfiguration, factory reset) until the device reboots.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the GET /json/cfg handler to perform the same settings-PIN check used by the /edit endpoint (i.e., do not call serveJson() without verifying correctPIN).
WLED (wled00/wled_server.cpp) Authorization check on GET /json/cfg (serveJson) = Require settings-PIN / correctPIN to be true before responding
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71264?
CVE-2026-71264 has a severity score of 8.2, indicating a high risk vulnerability.
How do I fix CVE-2026-71264?
To fix CVE-2026-71264, ensure that the /json/cfg endpoint requires appropriate authentication and implement a settings-PIN check.
What does CVE-2026-71264 affect?
CVE-2026-71264 affects the WLED software, allowing unauthenticated access to sensitive configuration information.
Can CVE-2026-71264 lead to unauthorized access?
Yes, CVE-2026-71264 can lead to unauthorized access by disclosing device configuration to any unauthenticated client on the network.
When was CVE-2026-71264 published?
CVE-2026-71264 was published on August 5, 2026.