Loading vulnerability…
Authentication Bypass in UniFi Protect Application API Endpoints
CVE-2026-54407 is an improper access control vulnerability in UniFi Protect Application that allows a network-adjacent attacker to bypass authentication on certain API endpoints. The flaw affects UniFi Protect Application version 7.1.77 and earlier. Successful exploitation permits access to protected API functionality without normal authentication checks, indicating that authorization is not correctly enforced on exposed endpoints.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker on the adjacent network to access certain UniFi Protect Application API endpoints without authenticating. This can result in unauthorized access to protected functionality and associated data, undermining confidentiality and integrity controls within the application. Depending on the reachable endpoint behavior, the flaw may also facilitate follow-on actions against the affected Protect environment.
If you can’t patch tonight, do this now.
No interim workaround is currently available. Reduce exposure by limiting network adjacency to trusted management networks, restricting access to UniFi Protect interfaces and APIs through segmentation and access controls, and monitoring for unauthorized API activity until the fixed version can be deployed.
Patch, then assume compromise.
Upgrade UniFi Protect Application to version 7.1.83 or later, which contains the vendor-provided fix for this vulnerability. Because the vendor stated that no interim workarounds are available for the affected vulnerabilities in this bulletin, prompt patching is the primary remediation action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.