CVE-2026-54408 is a high severity improper access control flaw (CVSS 8.6) in the UniFi Protect Application. A malicious actor with network access could bypass authentication for data streaming. The record gives no version numbers, so use Ubiquiti Security Advisory Bulletin 066 to find the fixed release for your console.
What's affected
- UniFi Protect Application, per the record.
- Affected and fixed versions: not stated in the record. Ubiquiti Security Advisory Bulletin 066 is the vendor source. Its page loads dynamically, so open it in a browser and read the version table.
- The record describes the attacker as someone with access to the network.
How to check if you're exposed
Open the UniFi Protect application and read the version in its settings. Then open Bulletin 066 and compare it with the fixed version listed for your product. Also check where the console sits. A Protect console that is reachable only from a management network is much harder to attack than one reachable from guest or user networks, so note the VLANs that can reach it.
What to do now
- Read Bulletin 066 and find the fixed UniFi Protect version.
- Update the application on each console.
- Limit access to the console to management networks and trusted hosts.
- Review who has access to camera streams and revoke accounts you do not recognize.
Why it matters
The class is CWE-284, improper access control. A streaming path accepted requests that should have required authentication, so the data protected behind the login could be reached without it.
For camera systems, that is a privacy issue as well as a security one, since the data is video. The record does not mark the CVE as exploited in the wild. The same bulletin covers other Ubiquiti CVEs, so check the whole bulletin when you plan the update.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is video exposure confirmed?
The record says authentication for data streaming could be bypassed. It does not describe what data was reachable beyond that, so follow the bulletin.
Sources
Last reviewed: 19 October 2026.
