diff --git a/esphome/dashboard/web_server.py b/esphome/dashboard/web_server.py
index 52e16e1ad7d..3f29e54d24e 100644
--- a/esphome/dashboard/web_server.py
+++ b/esphome/dashboard/web_server.py
@@ -123,7 +123,7 @@ def is_authenticated(handler: BaseHandler) -> bool:
                 try:
                     auth_decoded = base64.b64decode(auth_header[6:]).decode()
                     username, password = auth_decoded.split(":", 1)
-                except (ValueError, UnicodeDecodeError):
+                except (binascii.Error, ValueError, UnicodeDecodeError):
                     return False
                 return settings.check_password(username, password)
         return handler.get_secure_cookie(AUTH_COOKIE_NAME) == COOKIE_AUTHENTICATED_YES
diff --git a/tests/dashboard/test_web_server.py b/tests/dashboard/test_web_server.py
index 985efa31571..66497088fb8 100644
--- a/tests/dashboard/test_web_server.py
+++ b/tests/dashboard/test_web_server.py
@@ -1707,6 +1707,14 @@ def test_is_authenticated_malformed_base64(
     assert web_server.is_authenticated(handler) is False
 
 
+def test_is_authenticated_bad_base64_padding(
+    mock_auth_settings: MagicMock,
+) -> None:
+    """Test that incorrect base64 padding (binascii.Error) returns False."""
+    handler = _make_auth_handler("Basic abc")
+    assert web_server.is_authenticated(handler) is False
+
+
 def test_is_authenticated_invalid_utf8(
     mock_auth_settings: MagicMock,
 ) -> None: