WLED vulnerabilities

1 known vulnerability in WLED from Aircoookie. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.2 High severity

  WLED: Missing Authorization

  CVE-2026-71264Aug 5, 2026Aircoookie

  WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any u