CVE-2026-77550: UniFi OS Authentication Bypass Vulnerability

CVE-2026-77550 Overview

CVE-2026-77550 is an authentication bypass vulnerability affecting certain devices running Ubiquiti UniFi OS. The flaw stems from improper neutralization of Carriage Return Line Feed (CRLF) sequences [CWE-93] in network-facing request handling. An unauthenticated attacker with network access to a vulnerable UniFi OS device can inject CRLF sequences to manipulate protocol parsing and bypass authentication controls. Successful exploitation grants access to UniFi OS devices or instances without valid credentials. The vulnerability carries a maximum CVSS score of 10.0 and impacts confidentiality, integrity, and availability across scope boundaries.

Critical Impact
Unauthenticated network attackers can bypass authentication on affected UniFi OS devices, gaining control of network infrastructure and any downstream systems the device manages.

Affected Products

Ubiquiti UniFi OS (specific versions listed in vendor advisory)
UniFi OS-powered network devices and controllers
Refer to Ubiquiti Security Advisory Bulletin 067 for the exact product and version list

Discovery Timeline

2026-08-26 - CVE-2026-77550 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77550

Vulnerability Analysis

The vulnerability resides in how UniFi OS parses incoming network requests containing CRLF character sequences (\r\n). CRLF characters are protocol delimiters in HTTP and other text-based protocols. When user-controlled input containing these sequences reaches parsers that fail to sanitize or reject them, an attacker can inject additional protocol elements. In this case, the injected content alters authentication decisions, allowing a request to be treated as authenticated when it should be rejected.

Because the attack path is exposed over the network and requires no privileges or user interaction, an attacker only needs reachability to the UniFi OS management interface. The scope-changing impact indicates that compromise of the device extends to resources beyond the vulnerable component itself, such as managed network segments and downstream clients.

Root Cause

The root cause is improper neutralization of CRLF sequences during input processing [CWE-93]. The affected code accepts request data containing raw \r\n bytes and forwards it into a context where those bytes are interpreted as protocol control characters. This enables HTTP response splitting, header injection, or authentication state manipulation depending on the affected parser.

Attack Vector

The attack requires network reachability to the UniFi OS device management interface, typically over HTTP or HTTPS. An attacker crafts a request that embeds CRLF sequences within a header value, URL parameter, or authentication field. The malformed request causes the authentication layer to accept the session or misroute the request past authentication checks. No credentials, tokens, or user interaction are required. Consult the Ubiquiti Security Advisory Bulletin 067 for vendor-specific technical details.

Detection Methods for CVE-2026-77550

Indicators of Compromise

HTTP requests to UniFi OS management endpoints containing encoded CRLF sequences such as %0d%0a, \r\n, or %0D%0A within headers or query parameters
Unexpected authenticated sessions on UniFi OS devices originating from previously unseen source IP addresses
Configuration changes, new administrative accounts, or firmware operations that do not correlate with authorized administrator activity
Anomalous outbound connections from UniFi OS devices to external hosts

Detection Strategies

Inspect web server and reverse proxy logs for request lines and headers containing raw or URL-encoded CRLF bytes targeting UniFi endpoints
Deploy network intrusion detection signatures that flag CRLF injection patterns in HTTP traffic destined for management interfaces
Baseline administrative activity on UniFi controllers and alert on authentication events that lack a corresponding login sequence

Monitoring Recommendations

Forward UniFi OS audit logs and web access logs to a centralized SIEM for correlation with authentication events
Monitor management VLANs for unexpected sources initiating sessions to UniFi controllers
Track firmware and configuration changes on UniFi devices and generate alerts on unauthorized modifications

How to Mitigate CVE-2026-77550

Immediate Actions Required

Apply the patched UniFi OS firmware released by Ubiquiti as documented in Security Advisory Bulletin 067
Restrict access to UniFi OS management interfaces to trusted administrative networks and VPN clients only
Audit UniFi devices for unauthorized accounts, configuration changes, and firmware modifications
Rotate administrative credentials and API keys on all UniFi OS instances that were network-reachable before patching

Patch Information

Ubiquiti has published fixed firmware versions in Security Advisory Bulletin 067. Administrators should review the advisory for the exact patched versions corresponding to each affected UniFi OS device family and upgrade all instances to a fixed release. Verify patch application by confirming the running firmware version against the vendor's fixed version list.

Workarounds

Block inbound access to UniFi OS management ports from untrusted networks at the perimeter firewall
Place UniFi OS devices behind a reverse proxy or web application firewall configured to reject requests containing CRLF sequences in headers and parameters
Disable remote access and cloud access features on UniFi OS devices until firmware updates are applied

bash

# Example: restrict UniFi OS management access to a trusted admin subnet
# Adjust interface names and admin CIDR to match your environment
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 8443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP