CVE-2026-54407: UniFi Protect Authentication Bypass (CVSS 8.6)

Technical summary

CVE-2026-54407 is an improper access control flaw (CWE-284) in UniFi Protect Application's API layer. The vulnerability permits an attacker with network connectivity to the affected application to bypass authentication mechanisms on specific API endpoints. The CVSS 3.1 vector (8.6 HIGH) reflects network-based attack feasibility with no authentication or user interaction required, resulting in partial confidentiality and integrity impact alongside high availability risk. The flaw does not require privilege escalation or special network positioning, making it straightforward to exploit once an attacker reaches the application.

Business impact

Authentication bypass on API endpoints creates significant operational risk. Attackers can access, modify, or disrupt protected video surveillance data and system configurations without credentials. For organizations relying on UniFi Protect for physical security monitoring, this vulnerability could enable unauthorized viewing of surveillance feeds, tampering with access logs, or system denial-of-service attacks. Regulatory compliance obligations (HIPAA, PCI-DSS, SOC 2) may be jeopardized if surveillance integrity cannot be guaranteed.

Affected systems

UniFi Protect Application by Ubiquiti Networks is affected. Verify your installed version against the vendor's security advisory to confirm whether your deployment is impacted. This applies regardless of deployment scale—from small office systems to large enterprise surveillance infrastructures.

Exploitability

Exploitation is straightforward: an attacker positioned on the network segment containing the UniFi Protect Application can directly call API endpoints without authentication. No special tools, user interaction, or privileged access is required. The attack surface includes any environment where the application is internet-facing or accessible from an untrusted network. Internal networks where threat actors have already established a foothold are equally vulnerable.

Remediation

Apply the vendor-supplied patch immediately upon availability. Verify the patch version against Ubiquiti's official security advisory. In the interim, implement network segmentation to restrict access to UniFi Protect Application APIs to trusted administrative networks only. Employ firewall rules, VPN enforcement, or layer-4 access controls to limit which hosts and subnets can reach the affected service.

Patch guidance

Consult Ubiquiti Networks' official security advisory for the specific patched version of UniFi Protect Application applicable to your deployment. Apply patches during a maintenance window to avoid surveillance service interruption. Test in a non-production environment first. After patching, verify API endpoints are no longer accessible without valid authentication by reviewing network logs and confirming failed authentication attempts are now blocked.

Detection guidance

Monitor UniFi Protect Application logs for API requests to sensitive endpoints (configuration, user management, video access) that lack valid authentication tokens or credentials. Look for repeated unauthenticated API calls from unexpected source IPs, particularly from external networks. Network-based detection should flag any traffic to the application's API port from hosts that are not known administrative clients. Check for unusual data access patterns or configuration changes that coincide with unrecognized login sessions.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.6), network accessibility, zero authentication requirements, and direct impact on physical security infrastructure. Unlike vulnerabilities requiring local access or user interaction, this flaw can be exploited by any attacker with network reach. Surveillance system compromise carries both operational and compliance consequences. Although not yet on the Known Exploited Vulnerabilities (KEV) catalog, the ease of exploitation increases the likelihood of active abuse.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects a HIGH severity rating driven by: (1) Network-based attack vector requiring no special positioning, (2) Low attack complexity—no privilege or authentication needed, (3) Partial confidentiality impact from unauthorized data access, (4) Partial integrity impact from potential configuration tampering, and (5) High availability risk if attackers disrupt the service. The combination of trivial exploit conditions and multi-faceted impact justifies the elevated score.

Frequently asked questions