CVE-2026-72581

Name of the Vulnerable Software and Affected Versions duhow/xiaoai-patch versions prior to commit fb07049

Description A server-side request forgery (SSRF) issue allows a remote attacker to force a Xiaomi smart speaker to perform HTTP requests to arbitrary internal or external URLs. This occurs because the '/auth' endpoint in api/main.py uses the url POST parameter to redirect to a Home Assistant instance without validating the destination URL, which can be used for internal network scanning and accessing internal services.

Recommendations Update duhow/xiaoai-patch to a version beyond commit fb07049. As a temporary mitigation, restrict access to the '/auth' endpoint to prevent unauthorized requests.