From 2dad6e4f626ae9a6d3a8d6b665bcf9a584be916c Mon Sep 17 00:00:00 2001
From: Firat Hajiyev <fi189352@ucf.edu>
Date: Mon, 12 Oct 2026 13:15:13 -0400
Subject: [PATCH] [wifi] Reject unsupported WPA3 on ESP8266 (#20592)

Co-authored-by: Firat17aze <187820330+Firat17aze@users.noreply.github.com>
---
 esphome/components/wifi/__init__.py           |  7 ++
 .../wifi/test_min_auth_mode.py                | 79 +++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 tests/component_tests/wifi/test_min_auth_mode.py

diff --git a/esphome/components/wifi/__init__.py b/esphome/components/wifi/__init__.py
index 61f242d8caf..667e288fd72 100644
--- a/esphome/components/wifi/__init__.py
+++ b/esphome/components/wifi/__init__.py
@@ -345,6 +345,12 @@ def validate_variant(_):
             )
 
 
+def _validate_min_auth_mode(value: str) -> str:
+    if value == "WPA3" and CORE.is_esp8266:
+        raise cv.Invalid("ESP8266 does not support WPA3; use WPA or WPA2 instead")
+    return value
+
+
 def _apply_min_auth_mode_default(config):
     """Apply platform-specific default for min_auth_mode."""
     if CONF_MIN_AUTH_MODE not in config and (CORE.is_esp8266 or CORE.is_esp32):
@@ -556,6 +562,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_MIN_AUTH_MODE): cv.All(
                 VALIDATE_WIFI_MIN_AUTH_MODE,
                 cv.only_on([Platform.ESP32, Platform.ESP8266]),
+                _validate_min_auth_mode,
             ),
             cv.SplitDefault(CONF_OUTPUT_POWER, esp8266=20.0): cv.All(
                 cv.decibel, cv.float_range(min=8.5, max=20.5)
diff --git a/tests/component_tests/wifi/test_min_auth_mode.py b/tests/component_tests/wifi/test_min_auth_mode.py
new file mode 100644
index 00000000000..e0e5ca98053
--- /dev/null
+++ b/tests/component_tests/wifi/test_min_auth_mode.py
@@ -0,0 +1,79 @@
+"""Platform restrictions for minimum Wi-Fi authentication modes."""
+
+import pytest
+
+from esphome import config_validation as cv
+from esphome.components.esp32 import KEY_VARIANT
+from esphome.components.esp32.const import VARIANT_ESP32
+from esphome.components.wifi import CONF_MIN_AUTH_MODE, CONFIG_SCHEMA
+from esphome.const import PlatformFramework
+from tests.component_tests.types import SetCoreConfigCallable
+
+
+def _validate(mode: str | None = None) -> dict:
+    config = {"ssid": "net", "password": "secret12", "use_address": "test.local"}
+    if mode is not None:
+        config[CONF_MIN_AUTH_MODE] = mode
+    return CONFIG_SCHEMA(config)
+
+
+@pytest.mark.parametrize("mode", ["WPA3", "wpa3"])
+def test_esp8266_rejects_wpa3(
+    set_core_config: SetCoreConfigCallable, mode: str
+) -> None:
+    set_core_config(PlatformFramework.ESP8266_ARDUINO)
+    with pytest.raises(cv.Invalid, match="ESP8266 does not support WPA3") as exc:
+        _validate(mode)
+    assert exc.value.path == [CONF_MIN_AUTH_MODE]
+
+
+@pytest.mark.parametrize(
+    ("platform", "mode"),
+    [
+        (PlatformFramework.ESP8266_ARDUINO, "WPA"),
+        (PlatformFramework.ESP8266_ARDUINO, "WPA2"),
+        (PlatformFramework.ESP32_IDF, "WPA"),
+        (PlatformFramework.ESP32_IDF, "WPA2"),
+        (PlatformFramework.ESP32_IDF, "WPA3"),
+        (PlatformFramework.ESP32_IDF, "wpa3"),
+        (PlatformFramework.ESP32_ARDUINO, "WPA"),
+        (PlatformFramework.ESP32_ARDUINO, "WPA2"),
+        (PlatformFramework.ESP32_ARDUINO, "WPA3"),
+    ],
+)
+def test_supported_modes(
+    set_core_config: SetCoreConfigCallable, platform: PlatformFramework, mode: str
+) -> None:
+    set_core_config(
+        platform,
+        platform_data=(
+            {KEY_VARIANT: VARIANT_ESP32}
+            if platform
+            in (PlatformFramework.ESP32_IDF, PlatformFramework.ESP32_ARDUINO)
+            else None
+        ),
+    )
+    assert _validate(mode)[CONF_MIN_AUTH_MODE] == mode.upper()
+
+
+@pytest.mark.parametrize(
+    "platform",
+    [
+        PlatformFramework.ESP8266_ARDUINO,
+        PlatformFramework.ESP32_IDF,
+        PlatformFramework.ESP32_ARDUINO,
+    ],
+)
+def test_default_remains_wpa2(
+    set_core_config: SetCoreConfigCallable, platform: PlatformFramework
+) -> None:
+    set_core_config(
+        platform,
+        platform_data=(
+            {KEY_VARIANT: VARIANT_ESP32}
+            if platform
+            in (PlatformFramework.ESP32_IDF, PlatformFramework.ESP32_ARDUINO)
+            else None
+        ),
+    )
+    assert _validate()[CONF_MIN_AUTH_MODE] == "WPA2"