CVE-2026-54407

Executive Summary

CVE-2026-54407 is an Improper Access Control vulnerability affecting UniFi Protect Application, a video surveillance platform developed by Ubiquiti Inc. The vulnerability allows a malicious actor with network access to bypass authentication on certain UniFi Protect Application API endpoints, potentially gaining unauthorized access to sensitive surveillance data and administrative functionality. The vulnerability has a CVSS score of 8.6 (High), indicating significant severity. Currently, no patch is available from the vendor, and affected version information has not been publicly disclosed, leaving organizations running UniFi Protect deployments at risk. Successful exploitation could result in unauthorized video stream access, configuration tampering, and potential lateral movement within the network.

Technical Analysis

The vulnerability is classified as an Improper Access Control issue (CWE is listed as UNKNOWN in available metadata, though the access control class typically maps to CWE-284). The NVD description states that "a malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication in certain UniFi Protect Application API endpoints."

The core vulnerability mechanism revolves around authentication bypass in specific API endpoints of the UniFi Protect Application. UniFi Protect serves as the management and recording platform for UniFi cameras, providing both a web interface and a comprehensive REST API used by clients, mobile applications, and third-party integrations. The API is designed to enforce authentication tokens and session validation on all request paths to ensure that only authorized users can access camera feeds, recordings, and system configuration.

The flaw exists because certain API endpoints either fail to validate authentication tokens correctly or are inadvertently exposed without proper access control enforcement. This is a common class of vulnerability where developers overlook certain endpoints during access control implementation, often leaving debug endpoints, health check routes, or legacy API versions incorrectly accessible.

An attacker exploiting this vulnerability does not require valid credentials. Instead, the attacker must have network-level access to the UniFi Protect Application, meaning the application must be reachable on the network from the attacker's position. This could be from within the same local network segment or from an external position if the application is exposed to the internet through port forwarding or a VPN.

The attack surface includes all API endpoints handled by the UniFi Protect Application. Since the NVD description does not specify the exact endpoints or the version range affected, the scope of vulnerable functionality remains unidentified from public technical writeups. However, the authentication bypass nature suggests the attacker could potentially enumerate API endpoints to identify which ones are accessible without valid tokens.

The fact that CVSS score is 8.6 with the vector being UNKNOWN in available data suggests a network attack vector (AV:N) with low attack complexity. The high score indicates significant potential for confidentiality and integrity impact.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker begins by identifying UniFi Protect Application instances on the network. This is typically accomplished through network scanning using tools such as Nmap to discover hosts listening on the default UniFi Protect ports (TCP 7443 for HTTPS API, TCP 7080 for HTTP API, TCP 7442 for camera real-time updates). Shodan and Censys can also be used to discover internet-exposed instances. Fingerprinting confirms the target when responding servers present headers or banners identifying UniFi Protect or when the default web login page for UniFi Protect is returned.

Step 2: Endpoint Enumeration and Probing

Once the target is identified, the attacker enumerates API endpoints to determine which paths are accessible without authentication. Common API paths for similar products include /api/, /v1/, /proxy/, and /auth/ paths. The attacker sends unauthenticated HTTP requests to these endpoints, analyzing status codes. A response with HTTP 200 (OK) rather than HTTP 401 (Unauthorized) or HTTP 403 (Forbidden) indicates a vulnerable endpoint. This probing can be automated with tools like Burp Suite Intruder or a custom script that iterates through a list of known UniFi Protect API paths.

Step 3: Authentication Bypass Weaponization

The attacker crafts specific HTTP requests targeting the vulnerable API endpoints identified in the previous step. Since the vulnerability allows bypassing authentication, the attacker does not need to present a valid session cookie or API token. The request may include crafted headers or simply a direct request to the endpoint path, depending on the exact nature of the flaw. If the vulnerable endpoint is not immediately apparent, the attacker tests variations of standard API paths, including version prefixes (/v1, /v2), resource types (/cameras, /users, /system), and HTTP methods (GET, POST, PUT, DELETE).

Step 4: Payload Execution and Data Exfiltration

With successful authentication bypass, the attacker accesses surveillance data and functions. If camera listing endpoints are vulnerable, the attacker retrieves the list of all cameras, their IP addresses, names, and locations. If video stream endpoints are accessible, the attacker can pull live or recorded video feeds. If user management endpoints are exposed, the attacker can enumerate existing user accounts, potentially retrieve password hashes, or create new administrative accounts for persistent access. The attacker may also access system configuration files containing network topology details, storage configurations, and possibly credentials for other services.

Step 5: Post-Exploitation and Persistence

After gaining unauthorized access, the attacker establishes persistence by creating a backdoor account or modifying existing system settings. The attacker may disable camera recording, tamper with video evidence, or redirect video streams to an attacker-controlled destination. The attacker could also use the compromised UniFi Protect instance as a pivot point for lateral movement into the broader network, leveraging any credentials or network access information obtained from the application.

Impact Assessment

The CVSS score of 8.6 places this vulnerability in the High severity band (7.0-8.9). This reflects a network-exploitable vulnerability with low attack complexity that can be exploited by an unauthenticated attacker with network access.

Confidentiality Impact: High. Successful exploitation grants access to live and recorded surveillance video, which may contain sensitive information about personnel, facilities, operations, or private activities. Camera names and locations also reveal physical security layouts.

Integrity Impact: High. An attacker who bypasses authentication may be able to modify camera configurations, alter recording schedules, disable motion detection, or tamper with system settings.

Availability Impact: Low to Medium. While the attack primarily targets confidentiality and integrity, an attacker could potentially disrupt surveillance operations by causing system instability or intentionally misconfiguring components.

Affected Systems: UniFi Protect Application instances in enterprise deployments, including organizations using UniFi cameras for physical security, retail loss prevention, data center monitoring, and facility access control.

Blast Radius: Compromise of a UniFi Protect instance could expose physical security posture, allow surveillance disablement during physical intrusions, and provide network pivot opportunities. In multi-site deployments, a single compromised instance could reveal credentials or network paths to other locations.

Exploitability Context: With EPSS score of 0.00310 (23.4th percentile), this vulnerability is not currently widely exploited in the wild, but the availability of scoring above 8.5 typically attracts attacker attention. The lack of public patch suggests active exploitation window remains open.

Detection Guidance

Sigma Rule

title: UniFi Protect Authentication Bypass Attempt
id: 9f1c4e2a-7b3d-4e8f-9c2a-5d6b8e1f4a2c
status: experimental
description: Detects attempts to access UniFi Protect API endpoints without authentication tokens, potentially indicating exploitation of CVE-2026-54407.
author: Valtersit Threat Intelligence
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection_unauthenticated:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
    cs-uri-extension: 
      - '.json'
    cs-uri-query|contains:
      - '/api/'
      - '/proxy/'
      - '/v1/'
    sc-status:
      - 200
      - 201
  selection_no_auth_header:
    cs-username: '""'
    cs-cookie: '""'
  filter_known_clients:
    cs-uri-query|contains:
      - 'token='
      - 'session='
  condition: selection_unauthenticated and selection_no_auth_header and not filter_known_clients
  timeframe: 30s
level: high
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2026-54407

YARA Rule

rule UniFi_Protect_AuthBypass_Discovery
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects reconnaissance patterns associated with UniFi Protect authentication bypass attempts"
        reference = "CVE-2026-54407"
        date = "2026-01-01"
        score = 75
    strings:
        $api_path = "/api/" ascii nocase
        $proxy_path = "/proxy/" ascii nocase
        $bootstrap = "bootstrap" ascii nocase
        $camera_ref = "cameras" ascii nocase
        $user_ref = "users" ascii nocase
        $system_info = "systeminformation" ascii nocase
        $auth_error = "unauthorized" ascii nocase
        $token_param = "?token=" ascii nocase
        $uniq_header = "uniFiOS-session" ascii nocase
    condition:
        (uint16(0) == 0x3C48 or uint16(0) == 0x0D0A) and
        3 of ($api_path, $proxy_path, $bootstrap, $camera_ref, $user_ref, $system_info) and
        not 1 of ($token_param, $uniq_header)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-54407 UniFi Protect Authentication Bypass Probing Attempt"; flow:established,to_server; content:"/api/"; http_uri; nocase; content:"/proxy/"; http_uri; nocase; content:"/v1/"; http_uri; nocase; pcre:"/(?:bootstrap|camera|user|system)/i"; classtype:attempted-admin; sid:202654407; rev:1; metadata:created_at 2026-01-01, updated_at 2026-01-01, cve 2026-54407, attack_target server, tag auth-bypass, signature_severity Major;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.action == "connection_established" and destination.port in (7443, 7080, 7442)]
  [http where http.request.method in ("GET", "POST", "PUT", "DELETE") and 
   http.request.uri contains "/api/" and
   http.request.uri contains "/proxy/" and
   url.path contains "=" and
   not http.request.headers contains "authorization" and
   not http.request.headers contains "cookie" and
   http.response.status_code < 400]

Splunk SPL Query

index=web sourcetype=access_combined
  uri_path IN ("/api/*", "/proxy/*", "/v1/*")
  AND status IN (200, 201, 204)
  AND NOT (token=* OR session=* OR cookie=*)
  | eval unpriv_curl = case(match(user_agent, "^curl/"), "yes", match(user_agent, "^(wget|python-requests)"), "yes", 1=1, "no")
  | lookup local=true uniFi_protect_asset_lookup dest_ip as src_ip
  | stats count min(_time) max(_time) values(uri_path) as accessed_paths by src_ip, dest_ip
  | where count > 5
  | convert ctime(min_time) as first_seen ctime(max_time) as last_seen
  | sort - count

Wazuh OSSEC Rule

<rule id="120001" level="15">
  <if_sid>31100</if_sid>
  <field name="url">\./api/\.*|\./proxy/\.*|\./v1/\.*</field>
  <field name="status">200</field>
  <regex>^(?!.*(token=|session=|auth))</regex>
  <description>CVE-2026-54407: UniFi Protect API access without authentication headers - possible authentication bypass.</description>
  <group>access_control, authentication_failure, web_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1) Immediate Mitigations (implement in order of priority):

• Restrict network access to the UniFi Protect Application API. Use a firewall or network access control list (ACL) to allow connections only from trusted administrative workstations and authorized client systems. Block access on ports 7443, 7080, and 7442 from all untrusted network segments.
• If UniFi Protect is exposed to the internet via port forwarding or a VPN, immediately remove the port forwarding rules and require VPN authentication for external access. Use a jump host or bastion for administrative access.
• Place the UniFi Protect instance on a segmented network, isolated from general user traffic and internet-facing services.
• Monitor authentication logs for failed authentication attempts and unauthorised API requests 24/7.

2) Patch/Upgrade Steps:

• Version info is unknown (NVD provides no fixed version); monitor the vendor’s official channels (community.ubnt.com and the release notes in the UniFi OS Console) daily for security advisories.
• Subscribe to the Ubiquiti security notification feed to be alerted when the vendor publishes the security advisory and fixed version for CVE-2026-54407.
• When a patched version is released, upgrade all UniFi Protect Application instances in a test environment first, verify API functionality for clients and mobile apps, then roll out to production systems during a maintenance window. Confirm the version number in the release notes exactly matches the advisory’s fixed version before deploying.

3) Long-Term Hardening:

• Disable direct internet exposure of the UniFi Protect Application. Access it only through a VPN or a dedicated reverse proxy with authentication enforcement.
• Implement a least-privilege model for API access: if the application supports API keys or access tokens, restrict them to the minimum scope and rotate them regularly.
• Enable audit logging in the UniFi Protect Application and integrate with a centralized security information and event management (SIEM) system.
• Conduct a security review of the existing deployment to identify and eliminate other potential authentication bypass opportunities.
• Implement network segmentation to isolate all surveillance infrastructure from production and guest networks.
• Establish configuration backups and a recovery procedure to clean up after a potential compromise.
• Review current firewall rules that allow access to UniFi Protect ports and contract them to the minimum required set.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54407 — Official NVD vulnerability record with description and CVSS score.
2. Ubiquiti Security Advisories: https://community.ui.com/releases — Official vendor release notes and security announcements; monitor for the advisory covering this CVE when published.
3. UniFi Protect Documentation: https://unifi.ui.com/protect — Official product documentation describing API usage, deployment architecture, and default ports.
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Framework classification for internet-exposed application exploitation.

No known threat actor campaigns have been publicly attributed to exploitation of this CVE as of January 2026. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations are strongly encouraged to monitor vendor advisories for patch availability and apply mitigations immediately.