What is the CVSS score of CVE-2026-54407?

CVE-2026-54407 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of UniFi Protect are affected by CVE-2026-54407?

Ubiquiti UniFi Protect installations face an unpatched authentication bypass (CVE-2026-54407) that permits unauthenticated, network-adjacent attackers to access surveillance management functions,…. A patch is available.

How to fix or mitigate CVE-2026-54407?

24 hours: Identify all UniFi Protect deployments; verify network isolation from untrusted networks; audit current connectivity and administrative access patterns. 7 days: Deploy firewall ACLs restricting API endpoint access to authorized administrative networks only; configure detailed audit logging of API access attempts; enable alerting for unauthorized access patterns. 30 days: Confirm patch availability timeline with Ubiquiti; conduct comprehensive security assessment of network access controls; develop contingency plan for alternative surveillance platforms if vendor patch is unavailable within 90 days.

UniFi Protect CVE-2026-54407

EUVD-2026-41379 HIGH

Improper Access Control (CWE-284)

2026-07-02 hackerone

GHSA-x7fp-rqc2-wmg4

Authentication Bypass Ubiquiti Unifi Protect Application

8.6

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

8.6 HIGH

Unauthenticated network-reachable API bypass (AV:N/AC:L/PR:N/UI:N); limited data exposure and tampering (C:L/I:L) with high service-disruption impact (A:H), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:35 vuln.today

DescriptionCVE.org

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints.

AnalysisAI

Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints without valid credentials due to improper access control (CWE-284). Rated CVSS 8.6, the flaw combines low confidentiality and integrity impact with high availability impact, meaning an unauthenticated actor on the network could interact with protected surveillance-management functions. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the network vector with no privileges required (AV:N/PR:N) makes it a meaningful exposure for internet- or LAN-reachable deployments.

Technical ContextAI

UniFi Protect is Ubiquiti's video surveillance and NVR platform, running as an application on UniFi consoles (e.g., UDM/UNVR appliances) and exposing a REST-style API for camera, recording, and system management. The root cause is CWE-284 Improper Access Control: one or more API endpoints fail to correctly enforce authentication/authorization checks, so requests that should require a valid session are served anyway. Rather than a memory-safety or injection issue, this is a logic/access-control defect where the endpoint's guard is missing, misordered, or improperly scoped. The single CPE affected is cpe:2.3:a:ubiquiti_inc:unifi_protect_application, confirming the vulnerable component is the Protect application itself rather than firmware or a specific camera model.

RemediationAI

Patch available per vendor advisory: upgrade the UniFi Protect Application to the fixed version identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); an exact fix version was not included in the provided data, so confirm the target build from that advisory before updating. Because Protect runs on UniFi consoles, apply the update through the console/UniFi OS update mechanism and reboot if prompted. Until patched, restrict network reachability of the Protect management interface and its API: do not expose the console to the internet, place it on a management VLAN, require VPN for remote administration, and firewall the API ports to trusted admin hosts only - the trade-off is reduced convenience for remote camera access, but it directly removes the AV:N exposure that this bypass depends on. Avoid relying on remote access features or port-forwarding to the console while unpatched.