CVE-2026-3559

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-323

Affected software

Vendor	Product	Versions
Philips	Hue Bridge	1.73.1973146020

References

https://www.zerodayinitiative.com/advisories/ZDI-26-157/Third Party Advisory

Timeline

Published: Mar 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-355905.5libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was n CVE-2026-355917.8libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 c CVE-2026-355926.5pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/p CVE-2026-355936.8Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0 CVE-2026-355946.5Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims CVE-2026-355958.3Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139 CVE-2026-355964.3Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel function contains a SQL operator preced CVE-2026-355977.5Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional CVE-2026-355984.3Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch CVE-2026-355996.5Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that CVE-2026-35608.8Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows CVE-2026-356005.4Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax