CVE-2026-77550

CriticalCVSS 10.0/10Last modified Aug 28, 2026

Description

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Aug 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-775519.0A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un CVE-2026-775529.8A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video CVE-2026-775539.9A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access CVE-2026-7755410.0A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exe CVE-2026-775557.5A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex CVE-2026-775567.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe CVE-2026-775579.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalat CVE-2026-775587.5A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe CVE-2026-775608.1Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse CVE-2026-775615.3Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login req CVE-2026-775643.3Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field f CVE-2026-775678.1Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challen