ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON 'state' field correctly masked as "", but the same serialization path unconditionally writes the raw password into the JSON 'value' field via set_json_icon_state_value/set_json_value. This flaw exposes stored passwords in plaintext; an attacker can retrieve them by accessing the GET /text/<entity_id> endpoint or via the /events EventSource stream, potentially exposing Wi‑Fi passwords or API tokens that may allow deeper device or network compromise.

All ESPHome deployments that include the web_server component and use a TEXT_MODE_PASSWORD configuration are vulnerable, including firmware builds up to 2026.7.0-dev. The vulnerability applies to devices that expose the web_server on the default port 80 without authentication, such as smart home devices, sensors, or other ESP‑based controllers that run the open-source firmware.

The CVSS base score of 6.5 indicates moderate severity. Because the web_server listens on port 80 by default and requires no authentication, an attacker on the same local network can exploit the flaw by sending a simple HTTP request, obtaining the plaintext password via the JSON response. EPSS score of 0.00208 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication and the direct exposure of credentials make it a practical local‑network attack vector.