CVE-2026-22566: UniFi Play Auth Bypass Vulnerability

CVE-2026-22566 Overview

An Improper Access Control vulnerability has been identified in Ubiquiti's UniFi Play product line that could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials. This vulnerability represents a significant security risk as it enables unauthorized disclosure of sensitive network credentials, potentially compromising the integrity of the entire wireless network infrastructure.

Critical Impact

Attackers with network access can extract WiFi credentials from vulnerable UniFi Play devices, enabling unauthorized network access and potential lateral movement within the environment.

Affected Products

• UniFi Play PowerAmp (Version 1.0.35 and earlier)
• UniFi Play Audio Port (Version 1.0.24 and earlier)

Discovery Timeline

• April 13, 2026 - CVE-2026-22566 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22566

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), indicating that the affected UniFi Play devices fail to properly restrict access to sensitive configuration data. The flaw allows an attacker who has already gained access to the UniFi Play network segment to query or extract stored WiFi credentials without proper authentication or authorization checks.

The network-based attack vector means exploitation can occur remotely from anywhere on the same network segment, without requiring user interaction or elevated privileges. The vulnerability impacts confidentiality by exposing sensitive credential data, though it does not directly allow modification of configurations or denial of service conditions.

Root Cause

The root cause of this vulnerability is insufficient access control mechanisms within the UniFi Play firmware. The affected devices do not properly validate that requests for sensitive configuration data—specifically WiFi credentials—originate from authorized administrative sessions. This allows any network-connected entity to retrieve credential information that should be restricted to authenticated administrators only.

Attack Vector

An attacker positioned on the UniFi Play network can exploit this vulnerability by sending crafted requests to the vulnerable device endpoints. Since no authentication is required (as indicated by the network attack vector with no privileges required), the attacker can directly access and retrieve the stored WiFi credentials.

The attack flow involves:

1. Attacker gains access to the network segment where UniFi Play devices operate
2. Attacker identifies vulnerable UniFi Play PowerAmp or Audio Port devices
3. Attacker sends requests to device endpoints that expose credential information
4. Device returns WiFi credentials without verifying authorization
5. Attacker can use obtained credentials to access the WiFi network or conduct further attacks

Detection Methods for CVE-2026-22566

Indicators of Compromise

• Unusual network queries or API requests targeting UniFi Play device management interfaces
• Unexpected access to device configuration endpoints from non-administrative hosts
• Network reconnaissance activity specifically targeting UniFi Play devices on ports used for management
• Authentication logs showing credential usage from unfamiliar devices after potential credential theft

Detection Strategies

• Monitor network traffic for unusual communication patterns with UniFi Play devices
• Implement network segmentation and monitor cross-segment access attempts to IoT devices
• Deploy intrusion detection rules to identify credential harvesting attempts against IoT devices
• Review device access logs for anomalous query patterns

Monitoring Recommendations

• Enable logging on network infrastructure to capture traffic to and from UniFi Play devices
• Implement alerting for any access to UniFi Play management interfaces from unauthorized network segments
• Conduct regular audits of devices connected to the UniFi Play network segment
• Monitor for new or unauthorized devices appearing on WiFi networks that use credentials stored on vulnerable devices

How to Mitigate CVE-2026-22566

Immediate Actions Required

• Update UniFi Play PowerAmp to Version 1.0.38 or later immediately
• Update UniFi Play Audio Port to Version 1.1.9 or later immediately
• Isolate UniFi Play devices on a dedicated network segment with restricted access
• Rotate WiFi credentials that may have been exposed through vulnerable devices
• Audit network access logs for any signs of prior exploitation

Patch Information

Ubiquiti has released firmware updates to address this vulnerability. Organizations should apply the following updates as soon as possible:

• UniFi Play PowerAmp: Update to Version 1.0.38 or later
• UniFi Play Audio Port: Update to Version 1.1.9 or later

For detailed patch information and download links, refer to the UI Community Security Advisory.

Workarounds

• Implement strict network segmentation to isolate UniFi Play devices from sensitive network resources
• Apply firewall rules to restrict access to UniFi Play device management interfaces to authorized administrative hosts only
• Consider disabling network management interfaces on devices until patches can be applied
• Monitor network traffic to and from UniFi Play devices for suspicious activity until updates are deployed

# Example network segmentation firewall rule (iptables)
# Restrict access to UniFi Play devices to management VLAN only
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.50.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.50.0/24 -j DROP
# Replace 192.168.10.0/24 with your management network
# Replace 192.168.50.0/24 with your UniFi Play device network