### What happened?
By randomly going to my zigbee2mqtt instance on the 11th of …november, I noticed a new device I didn't know had joined the network 30 minutes earlier.
I use a setup with a passlist where all my zigbee devices are referenced, and I do not permit joining. I only use the button "Permit join (xxx)" when, and only when, I need a new device to join.
When I checked the logs, here are the following information I found :
```
zigbee2mqtt | [2024-11-11 16:39:09] info: zh:controller:greenpower: Received commissioning from '54394'
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/availability', payload '{"state":"online"}'
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Device '0x000000000041d47a' joined
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m:mqtt: MQTT publish: topic 'homeassistant/sensor/0x000000000041d47a/action/config', payload '{"availability":[{"topic":"zigbee2mqtt/bridge/state","value_template":"{{ value_json.state }}"},{"topic":"zigbee2mqtt/0x000000000041d47a/availability","value_template":"{{ value_json.state }}"}],"availability_mode":"all","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"enabled_by_default":true,"entity_category":"diagnostic","icon":"mdi:gesture-double-tap","name":"Action","object_id":"0x000000000041d47a_action","origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"state_topic":"zigbee2mqtt/0x000000000041d47a","unique_id":"0x000000000041d47a_action_zigbee2mqtt","value_template":"{{ value_json.action }}"}'
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Successfully interviewed '0x000000000041d47a', device has successfully been paired
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Device '0x000000000041d47a' is supported, identified as: Philips Hue tap (8718696743133)
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"last_seen":"2024-11-11T15:39:10.433Z","linkquality":211}'
zigbee2mqtt | [2024-11-11 16:39:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/bridge/event', payload '{"data":{"friendly_name":"0x000000000041d47a","ieee_address":"0x000000000041d47a"},"type":"device_joined"}'
zigbee2mqtt | [2024-11-11 16:39:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/bridge/event', payload '{"data":{"definition":{"description":"Hue tap","exposes":[{"access":1,"category":"diagnostic","description":"Triggered action (e.g. a button click)","label":"Action","name":"action","property":"action","type":"enum","values":["press_1","press_2","press_3","press_4"]},{"access":1,"category":"diagnostic","description":"Link quality (signal strength)","label":"Linkquality","name":"linkquality","property":"linkquality","type":"numeric","unit":"lqi","value_max":255,"value_min":0}],"model":"8718696743133","options":[],"supports_ota":false,"vendor":"Philips"},"friendly_name":"0x000000000041d47a","ieee_address":"0x000000000041d47a","status":"successful","supported":true},"type":"device_interview"}'
zigbee2mqtt | [2024-11-11 16:39:11] info: z2m:mqtt: MQTT publish: topic 'homeassistant/sensor/0x000000000041d47a/linkquality/config', payload '{"availability":[{"topic":"zigbee2mqtt/bridge/state","value_template":"{{ value_json.state }}"},{"topic":"zigbee2mqtt/0x000000000041d47a/availability","value_template":"{{ value_json.state }}"}],"availability_mode":"all","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"enabled_by_default":false,"entity_category":"diagnostic","icon":"mdi:signal","name":"Linkquality","object_id":"0x000000000041d47a_linkquality","origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"state_class":"measurement","state_topic":"zigbee2mqtt/0x000000000041d47a","unique_id":"0x000000000041d47a_linkquality_zigbee2mqtt","unit_of_measurement":"lqi","value_template":"{{ value_json.linkquality }}"}'
zigbee2mqtt | [2024-11-11 16:39:11] info: z2m:mqtt: MQTT publish: topic 'homeassistant/sensor/0x000000000041d47a/last_seen/config', payload '{"availability":[{"topic":"zigbee2mqtt/bridge/state","value_template":"{{ value_json.state }}"},{"topic":"zigbee2mqtt/0x000000000041d47a/availability","value_template":"{{ value_json.state }}"}],"availability_mode":"all","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"device_class":"timestamp","enabled_by_default":false,"entity_category":"diagnostic","icon":"mdi:clock","name":"Last seen","object_id":"0x000000000041d47a_last_seen","origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"state_topic":"zigbee2mqtt/0x000000000041d47a","unique_id":"0x000000000041d47a_last_seen_zigbee2mqtt","value_template":"{{ value_json.last_seen }}"}'
zigbee2mqtt | [2024-11-11 16:39:28] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_1","last_seen":"2024-11-11T15:39:28.121Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:39:28] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:28.121Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:39:28] info: z2m:mqtt: MQTT publish: topic 'homeassistant/device_automation/0x000000000041d47a/action_press_1/config', payload '{"automation_type":"trigger","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"payload":"press_1","subtype":"press_1","topic":"zigbee2mqtt/0x000000000041d47a/action","type":"action"}'
zigbee2mqtt | [2024-11-11 16:39:28] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_1'
zigbee2mqtt | [2024-11-11 16:39:37] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_2","last_seen":"2024-11-11T15:39:37.379Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:39:37] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:37.379Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:39:37] info: z2m:mqtt: MQTT publish: topic 'homeassistant/device_automation/0x000000000041d47a/action_press_2/config', payload '{"automation_type":"trigger","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"payload":"press_2","subtype":"press_2","topic":"zigbee2mqtt/0x000000000041d47a/action","type":"action"}'
zigbee2mqtt | [2024-11-11 16:39:37] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_2'
zigbee2mqtt | [2024-11-11 16:39:44] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_3","last_seen":"2024-11-11T15:39:44.444Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:39:44] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:44.444Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:39:44] info: z2m:mqtt: MQTT publish: topic 'homeassistant/device_automation/0x000000000041d47a/action_press_3/config', payload '{"automation_type":"trigger","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"payload":"press_3","subtype":"press_3","topic":"zigbee2mqtt/0x000000000041d47a/action","type":"action"}'
zigbee2mqtt | [2024-11-11 16:39:44] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_3'
zigbee2mqtt | [2024-11-11 16:39:49] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_4","last_seen":"2024-11-11T15:39:49.316Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:39:49] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:49.316Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:39:49] info: z2m:mqtt: MQTT publish: topic 'homeassistant/device_automation/0x000000000041d47a/action_press_4/config', payload '{"automation_type":"trigger","device":{"identifiers":["zigbee2mqtt_0x000000000041d47a"],"manufacturer":"Philips","model":"Hue tap (8718696743133)","name":"0x000000000041d47a","via_device":"zigbee2mqtt_bridge_0xe0798dfffeeaffd0"},"origin":{"name":"Zigbee2MQTT","sw":"1.40.2","url":"https://www.zigbee2mqtt.io"},"payload":"press_4","subtype":"press_4","topic":"zigbee2mqtt/0x000000000041d47a/action","type":"action"}'
zigbee2mqtt | [2024-11-11 16:39:49] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_4'
zigbee2mqtt | [2024-11-11 16:39:57] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_1","last_seen":"2024-11-11T15:39:57.325Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:39:57] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:57.325Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:39:57] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_1'
zigbee2mqtt | [2024-11-11 16:39:58] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_2","last_seen":"2024-11-11T15:39:58.952Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:39:58] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:39:58.952Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:39:58] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_2'
zigbee2mqtt | [2024-11-11 16:40:07] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_3","last_seen":"2024-11-11T15:40:07.518Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:40:07] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:40:07.518Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:40:07] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_3'
zigbee2mqtt | [2024-11-11 16:40:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_4","last_seen":"2024-11-11T15:40:11.660Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:40:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:40:11.660Z","linkquality":214}'
zigbee2mqtt | [2024-11-11 16:40:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_4'
zigbee2mqtt | [2024-11-11 16:40:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_1","last_seen":"2024-11-11T15:40:13.476Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:40:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:40:13.476Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:40:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_1'
zigbee2mqtt | [2024-11-11 16:42:57] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":null,"last_seen":"2024-11-11T15:42:57.887Z","linkquality":255}'
zigbee2mqtt | [2024-11-11 16:43:04] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":null,"last_seen":"2024-11-11T15:43:04.881Z","linkquality":255}'
zigbee2mqtt | [2024-11-11 16:43:09] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":null,"last_seen":"2024-11-11T15:43:09.897Z","linkquality":255}'
zigbee2mqtt | [2024-11-11 16:46:19] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_2","last_seen":"2024-11-11T15:46:19.485Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:46:19] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:46:19.485Z","linkquality":212}'
zigbee2mqtt | [2024-11-11 16:46:19] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_2'
zigbee2mqtt | [2024-11-11 16:48:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"press_1","last_seen":"2024-11-11T15:48:13.764Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:48:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":"","last_seen":"2024-11-11T15:48:13.764Z","linkquality":213}'
zigbee2mqtt | [2024-11-11 16:48:13] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a/action', payload 'press_1'
zigbee2mqtt | [2024-11-11 16:49:40] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":null,"last_seen":"2024-11-11T15:49:40.297Z","linkquality":255}'
zigbee2mqtt | [2024-11-11 16:51:34] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/0x000000000041d47a', payload '{"action":null,"last_seen":"2024-11-11T15:51:34.401Z","linkquality":255}'
zigbee2mqtt | [2024-11-11 17:15:42] info: z2m: Interviewing '0x000000000041d47a'
zigbee2mqtt | [2024-11-11 17:16:11] error: z2m: Request 'zigbee2mqtt/bridge/request/device/interview' failed with error: 'interview of '0x000000000041d47a' (0x000000000041d47a) failed: Error: Interview failed because can not get node descriptor ('0x000000000041d47a')'
zigbee2mqtt | [2024-11-11 17:16:11] info: z2m:mqtt: MQTT publish: topic 'zigbee2mqtt/bridge/response/device/interview', payload '{"data":{},"error":"interview of '0x000000000041d47a' (0x000000000041d47a) failed: Error: Interview failed because can not get node descriptor ('0x000000000041d47a')","status":"error","transaction":"e3c7x-1"}'
```
To filter out the noise from MQTT logs :
```
zigbee2mqtt | [2024-11-11 16:39:09] info: zh:controller:greenpower: Received commissioning from '54394'
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Device '0x000000000041d47a' joined
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Successfully interviewed '0x000000000041d47a', device has successfully been paired
zigbee2mqtt | [2024-11-11 16:39:10] info: z2m: Device '0x000000000041d47a' is supported, identified as: Philips Hue tap (8718696743133)
zigbee2mqtt | [2024-11-11 17:15:42] info: z2m: Interviewing '0x000000000041d47a'
zigbee2mqtt | [2024-11-11 17:16:11] error: z2m: Request 'zigbee2mqtt/bridge/request/device/interview' failed with error: 'interview of '0x000000000041d47a' (0x000000000041d47a) failed: Error: Interview failed because can not get node descriptor ('0x000000000041d47a')'
```
The address "0x000000000041d47a" is not in the passlist
I was not permitting joining at the time this device joined the network.
The first log indicates "commissioning" from "54394" which is D47A in hex, which awfully looks like the end of the address of the device that joined ("0x000000000041d47a")
I fear there might be a vulnerability allowing passlist and network joining bypass
### What did you expect to happen?
Since the passlist is enabled and Zigbee2MQTT configured to not permit join, I would expect the device not to have joined the network and produce logs such as follows (generated the day before during the pairing process of a new device) :
```
zigbee2mqtt | [2024-11-10 21:46:01] info: z2m: Rejecting joining not in passlist device '0xecf6************'
zigbee2mqtt | [2024-11-10 21:46:01] info: z2m: Rejecting joining not in passlist device '0xecf6************'
```
### How to reproduce it (minimal and precise)
As I don't know how it could have happened, I unfortunalety can't tell how to reproduce.
### Zigbee2MQTT version
1.40.2 (commit #e06848d)
### Adapter firmware version
7.4.1 [GA]
### Adapter
Sonoff ZBDongle-E (coordinator type=EmberZNet)
### Setup
Docker container on a Raspberry Pi 4
### Debug log
Debugging was not activated