CVE-2026-22566

Received Received - Intake

Improper Access Control in UniFi Play Devices Exposes WiFi Credentials

Publication date: 2026-04-13

Last updated on: 2026-04-13

Assigner: HackerOne

Description

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.  Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later  Update UniFi Play Audio Port to Version 1.1.9 or later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-13

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2026-04-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22566

EUVD

EUVD-2026-22095

Affected Vendors & Products

Vendor	Product	Version / Range
ubiquiti	unifi_play_poweramp	to 1.0.36 (exc)
ubiquiti	unifi_play_audio_port	to 1.0.25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Access Control issue in certain UniFi Play devices. It allows a malicious actor who already has access to the UniFi Play network to obtain the WiFi credentials of the UniFi Play devices.

Impact Analysis

If exploited, this vulnerability could allow an attacker within the UniFi Play network to retrieve WiFi credentials, potentially enabling unauthorized access to the network or devices connected to it.

Mitigation Strategies

To mitigate this vulnerability, update the affected UniFi Play devices to the fixed versions.

Update UniFi Play PowerAmp to Version 1.0.38 or later.
Update UniFi Play Audio Port to Version 1.1.9 or later.

Compliance Impact

This vulnerability allows a malicious actor with access to the UniFi Play network to obtain WiFi credentials due to improper access control.

Such unauthorized access to network credentials could potentially lead to unauthorized access to sensitive data or systems, which may impact compliance with standards and regulations that require protection of sensitive information, such as GDPR and HIPAA.

However, the provided information does not explicitly describe the direct impact on compliance with these regulations.

Hi! I’m here to help you understand CVE-2026-22566. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70