EUVD-2026-41394
GHSA-hp2q-c8xq-v8qv
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Network-reachable unauthenticated SSRF (AV:N/PR:N/UI:N) with high complexity preconditions (AC:H); scope-changed via server-side pivot (S:C), causing auth bypass (I:L) and DoS (A:H) with no data disclosure (C:N).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
AnalysisAI
Server-Side Request Forgery in Ubiquiti's UniFi Talk Application allows a network-positioned attacker to coerce the application into making unintended internal requests, resulting in a Denial of Service and an authentication bypass against certain UniFi Talk API endpoints. The flaw carries CVSS 7.5 (scope-changed, high availability impact) and is reachable by remote attackers without authentication (PR:N), though a high attack complexity (AC:H) constrains reliable exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
UniFi Talk is Ubiquiti's VoIP/telephony application within the UniFi Network ecosystem, typically hosted on a UniFi controller (UDM, Cloud Key, or self-hosted UniFi OS host) and exposing a set of REST API endpoints. The root cause is CWE-918 (Server-Side Request Forgery): the application accepts attacker-influenced input that is used to build outbound server-side requests without adequate validation of the destination. Because the CVSS scope is Changed (S:C), the SSRF pivots beyond the vulnerable component itself - the server acts as a confused deputy, issuing requests that reach resources or internal endpoints under a different security authority, which here manifests both as service disruption (A:H) and as a bypass of authentication controls on specific UniFi Talk API endpoints (I:L). The single affected CPE is cpe:2.3:a:ubiquiti_inc:unifi_talk_application:*:*:*:*:*:*:*:*, indicating all versions prior to the fix are in scope.
RemediationAI
Patch available per vendor advisory: apply the UniFi Talk Application update referenced in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc) - the exact fixed version was not provided in the input and should be taken directly from that advisory; do not assume a version number. Because exploitation is network-based, the most effective compensating control until patched is to restrict network reachability of the UniFi Talk API: place the controller/UniFi OS host behind a firewall or management VLAN and permit access only from trusted management networks and known SIP/Talk clients, which trades off remote administrative convenience and may break remote-worker phone provisioning. Avoid exposing the UniFi Talk management interface or its API directly to the internet, and monitor the host for anomalous outbound requests indicative of SSRF abuse. If UniFi Talk is not actively used, disabling or uninstalling the Talk application removes the attack surface entirely at the cost of telephony functionality.
More in Unifi Talk Application
View allRemote command injection in Ubiquiti's UniFi Talk Application lets a network-positioned attacker run arbitrary commands
Privilege escalation in Ubiquiti's UniFi Talk Application allows an authenticated attacker holding a low-privileged acco
Privilege escalation in Ubiquiti's UniFi Talk Application allows a low-privileged, network-adjacent user to gain elevate
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today