ZDI-26-156
HIGH 8.1
Published
Mar 06, 2026
Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability
Philips
A high-severity authentication bypass vulnerability (CVE-2026-3558, CVSS 8.1) affects Philips Hue Bridge, allowing network-adjacent attackers to gain unauthorized access without valid credentials. Successful exploitation could enable attackers to control smart lighting systems and potentially access connected network resources. Security teams should prioritize patching affected Philips Hue Bridge installations immediately and consider isolating vulnerable devices on separate network segments until updates are deployed.