CVE-2026-71264 — WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

CVE-2026-71264

WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State PUBLISHED

Description (CNA)

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network.

Affected (CNA)

Vendor / product	Versions
Aircoookie / WLED	affected 0 through *

CWE

CWE-862

References

https://github.com/Aircoookie/WLED
https://github.com/Aircoookie/WLED/blob/main/wled00/wled_server.cpp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.