UniFi OS CVE-2026-77550

The attacker needs network access to the targeted UniFi OS device's management/authentication interface (AV:N) and no credentials or user interaction (PR:N/UI:N), exploiting improper CRLF neutralization in the authentication path. The concrete prerequisite is reachability of the vulnerable UniFi OS auth endpoint - realistic where the console is internet-exposed or where the attacker is on the same local/adjacent network segment. The main limiting factor is therefore network reachability of the management plane: devices whose admin interface is confined to a trusted management VLAN or reachable only via VPN are substantially harder to hit, though no special non-default configuration is otherwise required for the bypass itself.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 10.0) describes a worst-case profile: remote, low-complexity, no privileges, no user interaction, full confidentiality/integrity/availability impact with scope change - a full authentication bypass yielding device compromise. That maximal rating warrants top-priority patching despite tempering signals: there is no EPSS score provided, no SSVC decision data, no POC, and no CISA KEV listing, so exploitation is not confirmed in the wild and the 10.0 is a theoretical-maximum severity rather than evidence of mass exploitation. Because UniFi devices are frequently internet-exposed and manage network perimeters, an unauthenticated bypass is exactly the class of flaw that gets weaponized quickly once details or a POC surface; any operator running these consoles should treat this as urgent and patch immediately rather than wait for exploitation evidence. Note also a mild internal inconsistency to verify with the vendor: the description frames this as bypassing authentication (typically same-scope), while the vector asserts S:C - the scope-change claim should be confirmed against Ubiquiti's advisory.

An attacker who can reach a UniFi OS console's management interface - for example an internet-exposed Cloud Gateway or an attacker positioned on the same LAN - sends a crafted request containing embedded CRLF sequences that manipulate the authentication handling, gaining access without valid credentials. From there they pivot to administer the device, alter firewall/routing, or access connected camera/NAS data. No public POC is identified at time of analysis, but the low attack complexity and lack of required privileges make reliable exploitation likely once technical details circulate.