Loading vulnerability…
Authentication Bypass for Data Streaming in UniFi Protect Application
CVE-2026-54408 is a high-severity improper access control vulnerability in the UniFi Protect Application. The flaw allows a network-accessible attacker to bypass authentication protections associated with data streaming functionality. Available information indicates the issue affects UniFi Protect Application version 7.1.77 and earlier and stems from insufficient enforcement of authorization checks on streaming-related access paths. Successful exploitation does not require prior authentication or user interaction and can expose protected streaming functionality to unauthorized parties.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker with network access to bypass authentication for UniFi Protect data streaming. This can result in unauthorized access to protected streamed content and associated application functionality. Reported scoring indicates high impact to confidentiality, integrity, and availability, meaning the flaw may enable broad unauthorized interaction with streaming resources and could undermine trust boundaries enforced by the application.
If you can’t patch tonight, do this now.
No interim vendor workaround was reported. Until patched versions can be deployed, reduce exposure by restricting network access to the UniFi Protect management and streaming interfaces to trusted administrative or surveillance networks only, enforcing segmentation and ACLs around reachable services, and monitoring for unauthorized access attempts or anomalous streaming activity.
Patch, then assume compromise.
Upgrade UniFi Protect Application to version 7.1.83 or later, as vendor-patched releases were provided for the affected product line. In addition to patching, access control enforcement for streaming-related functionality should be reviewed to ensure authentication and authorization checks are consistently applied across all relevant endpoints and request paths.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.