EUVD-2026-41383
GHSA-jrx2-468w-2jv8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network access bypasses auth for data streaming (AV:N/AC:L/PR:N), so C:H; SSVC 'partial' impact and streaming-only access justify I:L and A:N rather than full CIA.
Primary rating from Vendor (hackerone).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
AnalysisAI
Authentication bypass in Ubiquiti's UniFi Protect Application (versions before 7.1.83) allows a network-adjacent attacker to access data streaming without valid credentials due to improper access control. An unauthenticated attacker on a reachable network can view video/data streams that should be protected, with SSVC flagging the flaw as automatable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.27%), but the CVSS 9.8 rating and network exposure make it a meaningful patch priority.
Technical ContextAI
UniFi Protect is Ubiquiti's video surveillance and camera management platform (CPE cpe:2.3:a:ubiquiti_inc:unifi_protect_application), typically running on UniFi consoles (Cloud Key, Dream Machine/Dream Wall, UNVR) to manage IP camera fleets and their video streams. The root cause is classified as CWE-284 (Improper Access Control): the application fails to correctly enforce authorization checks on its data-streaming interface, so a request that should require an authenticated, authorized session is instead served without proper credential validation. Because the streaming endpoint is exposed over the network, the missing access-control gate is directly reachable rather than being protected behind a separate authentication layer.
RemediationAI
Vendor-released patch: upgrade the UniFi Protect Application to version 7.1.83 or later, which is the fixed release per Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); enabling automatic updates on the UniFi console ensures the fix is applied. Until the update is installed, reduce exposure by ensuring the UniFi Protect console and its streaming interface are not reachable from the internet or untrusted network segments - place it behind a firewall and restrict management/streaming access to a trusted VLAN or VPN, accepting that this limits legitimate remote viewing to VPN-connected clients. Because the flaw is a network-reachable authentication bypass, network-level access restriction is the primary compensating control while patching; disabling remote access features that expose the stream externally further shrinks the attack surface.
More in Unifi Protect Application
View allCommand injection in Ubiquiti's UniFi Protect Application lets a low-privileged, network-adjacent user run arbitrary ope
Command injection in Ubiquiti UniFi Protect Application lets a network-positioned, unauthenticated attacker run arbitrar
Privilege escalation via Server-Side Request Forgery in Ubiquiti's UniFi Protect Application allows a low-privileged, ne
Command injection in Ubiquiti's UniFi Protect Application lets a network-adjacent attacker holding only low-privileged c
Privilege escalation in Ubiquiti's UniFi Protect Application is possible through an authenticated SQL injection (CWE-89)
Authentication bypass in Ubiquiti UniFi Protect Application lets a network-adjacent attacker reach certain API endpoints
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacke
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today