CVE-2026-55110: UniFi OS CORS Misconfiguration Allows Authenticated Session Hijacking

Technical summary

CVE-2026-55110 is a Cross-Origin Resource Sharing (CWE-942) vulnerability in UniFi OS and related network appliances. The misconfigured CORS policy fails to properly restrict which external origins can make authenticated requests to the UniFi OS API. An attacker can host a malicious webpage that, when visited by an authenticated UniFi user, executes XMLHttpRequest or Fetch API calls against the UniFi OS backend using the victim's existing session credentials. The attack requires user interaction (visiting a malicious link) and moderately complex setup, but yields high impact once successful—attackers can read sensitive data, modify system configuration, and potentially disrupt operations.

Business impact

Organizations running UniFi infrastructure face operational risk if administrators are socially engineered into visiting attacker-controlled sites. A compromised session could allow unauthorized reconfiguration of network access controls, camera systems, or gateway rules, potentially exposing network segments or surveillance feeds. For managed service providers and enterprises with distributed UniFi deployments, a single successful attack could cascade across multiple customer environments if shared credentials or federated accounts are in use. The attack vector does not require network access to the UniFi device itself, only that an authorized user click a link—a plausible phishing or watering-hole scenario.

Affected systems

All UniFi OS deployments are affected, including UniFi OS Server running on general-purpose hardware, all Dream Machine models (Beast, Pro, Pro Max, Special Edition), Dream Router variants (including the DreamRouter 7), Dream Wall, Enterprise Fortress Gateway, UniFi Express 7, UniFi Cloud Key product line (standard, Plus, Enterprise), and all UniFi and Enterprise Network Video Recorder models. Both firmware and base hardware components carrying these operating systems require mitigation. This spans network controllers, routing/gateway appliances, and video surveillance infrastructure—a broad footprint across Ubiquiti's UniFi and Enterprise product tiers.

Exploitability

Exploitability is constrained by two factors: the attack requires user interaction (clicking a malicious link or visiting a compromised site), and it must target an authenticated user (attackers cannot exploit unauthenticated sessions). However, the attack is technically straightforward once those preconditions are met—CORS misconfiguration vulnerabilities are well-understood and do not require zero-days or advanced exploitation techniques. Social engineering campaigns, phishing emails, or compromised advertisements can reliably deliver the malicious link. The CVSS score of 7.5 (HIGH) reflects the high potential impact balanced against these interaction and authentication barriers. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited public weaponization to date.

Remediation

Organizations must apply vendor patches as soon as they become available through Ubiquiti's advisory. Interim mitigations include restricting network access to UniFi OS management interfaces to trusted IP ranges via firewall rules, reducing the likelihood that users can reach the devices from arbitrary internet locations. Implementing a Web Application Firewall (WAF) or reverse proxy in front of UniFi OS to inspect and enforce stricter CORS policies can provide layered defense. User awareness training emphasizing the risk of clicking links to unfamiliar sites, especially during administrative sessions, remains critical. Organizations should also audit active sessions and user permissions, disabling any unnecessary administrative accounts.

Patch guidance

Monitor Ubiquiti's official security advisories and UniFi OS release notes for patches addressing CVSS 3.1 7.5 vulnerabilities. Patches are typically released through the standard firmware update mechanism in the UniFi management console; test them in a non-production environment before broad deployment to ensure compatibility with local integrations. Verify against the vendor advisory that the patch version you deploy explicitly addresses CVE-2026-55110. For organizations running multiple UniFi appliances, coordinate patching to minimize downtime. Cloud-hosted UniFi OS instances may receive automatic updates; check your deployment model's update schedule.

Detection guidance

Monitor UniFi OS access logs for API calls originating from unexpected referrer headers or mismatched origin/referer combinations. Anomalous changes to network configuration, user permissions, or camera recording settings—especially those coinciding with administrator login activity from unusual times or geolocations—warrant investigation. Network-level detection is limited since the attack uses the legitimate authenticated session, but DNS logging for outbound requests to known phishing or malicious domains can provide upstream signals. Consider logging and alerting on high volumes of API calls within short time windows, which may indicate automated exploitation attempts.

Why prioritize this

Although this vulnerability requires user interaction and authentication, the breadth of affected products (spanning all major UniFi hardware and appliances), the ease of exploiting CORS misconfigurations once preconditions are met, and the HIGH severity all justify prompt patching. Organizations managing large or critical UniFi deployments should prioritize this in their patch cycle. If UniFi systems manage critical network functions or surveillance infrastructure, treat this as elevated priority to close the window before more widespread awareness and phishing campaigns emerge.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-accessible attack surface, high complexity due to user interaction and authentication requirements, and high impact across confidentiality, integrity, and availability. The attack does not escalate privileges or cross security boundaries (S:U), but it fully exploits the target's session to read sensitive data, modify settings, and potentially disrupt service.

Frequently asked questions