CVE-2026-21633: UniFi Protect Auth Bypass Vulnerability

CVE-2026-21633 Overview

CVE-2026-21633 is an authentication bypass vulnerability affecting the UniFi Protect Application. A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the UniFi Protect Application (Version 6.1.79 and earlier). This vulnerability stems from improper authentication (CWE-287) in the device discovery protocol, allowing attackers on the same network segment to bypass security controls and gain unauthorized camera access.

Critical Impact

Attackers on an adjacent network can exploit the discovery protocol to gain unauthorized access to UniFi Protect Cameras, potentially compromising video surveillance feeds, camera configurations, and sensitive security infrastructure.

Affected Products

• UniFi Protect Application (Version 6.1.79 and earlier)
• UniFi Protect Cameras connected to vulnerable UniFi Protect Applications
• UniFi surveillance infrastructure utilizing the affected discovery protocol

Discovery Timeline

• January 5, 2026 - CVE-2026-21633 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-21633

Vulnerability Analysis

This vulnerability exploits a weakness in the discovery protocol implementation within the UniFi Protect Application. The discovery protocol, designed to facilitate automatic detection and configuration of UniFi Protect Cameras on a network, fails to properly authenticate incoming requests. This improper authentication mechanism (CWE-287) allows an attacker positioned on an adjacent network to send crafted discovery requests that bypass normal authentication checks.

The adjacent network attack vector means that an attacker must have access to the same network segment as the target devices—this could include scenarios such as a compromised IoT device on the network, a malicious insider, or an attacker who has gained access to the local network through other means. Once positioned, the attacker can exploit the discovery protocol to enumerate and access UniFi Protect Cameras without proper authorization.

Root Cause

The root cause of CVE-2026-21633 lies in improper authentication handling within the UniFi Protect Application's discovery protocol implementation. The application fails to adequately verify the identity and authorization of entities attempting to interact with cameras through the discovery mechanism. This allows unauthenticated requests from adjacent network nodes to be processed as legitimate, granting unauthorized access to camera resources.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same network segment as the UniFi Protect infrastructure. From this position, the attacker can:

1. Send malicious discovery protocol packets to the UniFi Protect Application
2. Exploit the authentication bypass in the discovery protocol handling
3. Gain unauthorized access to connected UniFi Protect Cameras
4. Potentially view, modify, or disrupt camera operations

The attack does not require user interaction or any prior privileges, making it exploitable by any actor with adjacent network access. For detailed technical information, refer to the UI Community Security Advisory.

Detection Methods for CVE-2026-21633

Indicators of Compromise

• Unusual discovery protocol traffic patterns on network segments containing UniFi Protect infrastructure
• Unexpected device enumeration or camera access attempts from unauthorized network nodes
• Anomalous authentication events or access logs on UniFi Protect Application servers
• Unauthorized configuration changes to UniFi Protect Cameras

Detection Strategies

• Monitor network traffic for abnormal discovery protocol communications targeting UniFi Protect devices
• Implement network segmentation monitoring to detect lateral movement attempts toward surveillance infrastructure
• Deploy intrusion detection rules that alert on discovery protocol anomalies or unexpected source addresses
• Review UniFi Protect Application logs for authentication failures or unauthorized access patterns

Monitoring Recommendations

• Enable verbose logging on UniFi Protect Application to capture discovery protocol events
• Implement network-level monitoring on VLANs containing surveillance equipment
• Set up alerts for any camera access from non-administrative network segments
• Regularly audit connected devices and access patterns in UniFi Protect environments

How to Mitigate CVE-2026-21633

Immediate Actions Required

• Update UniFi Protect Application to Version 6.2.72 or later immediately
• Implement network segmentation to isolate UniFi Protect infrastructure from untrusted network segments
• Review access logs for any signs of unauthorized access or exploitation attempts
• Audit all connected cameras and verify their configuration integrity

Patch Information

Ubiquiti has released a security patch addressing this vulnerability. Users should update their UniFi Protect Application to Version 6.2.72 or later to remediate CVE-2026-21633. The patch corrects the authentication handling in the discovery protocol, ensuring proper verification of requests before granting camera access. For additional details, see the UI Community Security Advisory.

Workarounds

• Implement strict network segmentation to prevent untrusted devices from reaching the same network segment as UniFi Protect infrastructure
• Apply firewall rules to restrict discovery protocol traffic to authorized management hosts only
• Consider disabling the discovery protocol if not required for operations until patching is complete
• Deploy network access control (NAC) to authenticate all devices before allowing access to surveillance network segments

# Example network segmentation configuration (conceptual)
# Isolate UniFi Protect infrastructure on a dedicated VLAN
# Restrict inter-VLAN routing to authorized management hosts only
# Apply firewall rules to block discovery protocol from untrusted sources