Philips Hue Bridge Pro flaw lets adjacent attackers bypass authentication
Original title: ZDI-26-892: Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability
ZDI rates CVE-2026-122044 at CVSS 8.8 and says no authentication is required to exploit it.
ZDI published ZDI-26-892, a protection-mechanism failure in Philips Hue Bridge Pro tracked as CVE-2026-122044. Network-adjacent attackers can bypass authentication on affected installations without authenticating. ZDI assigned a CVSS rating of 8.8. The advisory does not state affected versions, a fix, or whether the flaw is exploited.
- The issue is CVE-2026-122044, published as ZDI-26-892.
- Attackers must be network-adjacent; authentication is not required.
- ZDI assigned a CVSS rating of 8.8.
- No affected or fixed versions are given.
Impact: Authentication bypass from the adjacent network
| Product | Affected |
|---|---|
| Philips Hue Bridge Pro | — |
- CVEs
- CVE-2026-122044
- Vendors
- Philips
- Products
- Hue Bridge Pro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-122044 | — | — | — |
From the original article
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.