WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly ch…

CVE-2026-71264 affects WLED, an open-source LED controller firmware. The GET /json/cfg endpoint exposes device configuration (network, hardware, LED setup) to any unauthenticated client on the network due to a missing settings-PIN check. Additionally, the PIN unlock state is stored as a single global boolean (correctPIN) rather than per-session state. Once any client successfully authenticates via POST /json, all subsequent clients gain full write access without authentication. This allows unauthenticated attackers to perform OTA firmware updates, reconfigure WiFi, or trigger factory resets. The vulnerability persists until the device reboots. These two flaws combined represent a serious information disclosure and authentication bypass risk for WLED-based IoT devices on local networks.