CVE-2026-22566
Improper Access Control in UniFi Play Devices Exposes WiFi Credentials
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: HackerOne
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ubiquiti | unifi_play_poweramp | to 1.0.36 (exc) |
| ubiquiti | unifi_play_audio_port | to 1.0.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Access Control issue in certain UniFi Play devices. It allows a malicious actor who already has access to the UniFi Play network to obtain the WiFi credentials of the UniFi Play devices.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker within the UniFi Play network to retrieve WiFi credentials, potentially enabling unauthorized access to the network or devices connected to it.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the affected UniFi Play devices to the fixed versions.
- Update UniFi Play PowerAmp to Version 1.0.38 or later.
- Update UniFi Play Audio Port to Version 1.1.9 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a malicious actor with access to the UniFi Play network to obtain WiFi credentials due to improper access control.
Such unauthorized access to network credentials could potentially lead to unauthorized access to sensitive data or systems, which may impact compliance with standards and regulations that require protection of sensitive information, such as GDPR and HIPAA.
However, the provided information does not explicitly describe the direct impact on compliance with these regulations.