CVE-2026-22566 is a CWE-284 improper access control vulnerability in Ubiquiti's UniFi Play PowerAmp and UniFi Play Audio Port devices. It allows an attacker with network access to the UniFi Play environment to retrieve WiFi credentials due to insufficient access restrictions. The vulnerability affects UniFi Play PowerAmp versions up to 1.0.35 and UniFi Play Audio Port versions up to 1.0.24. The vendor has released patched versions 1.0.38+ for PowerAmp and 1.1.9+ for Audio Port to address this issue. The CVSS v3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An attacker with access to the UniFi Play network could exploit this vulnerability to obtain WiFi credentials, potentially compromising network confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Update UniFi Play PowerAmp to version 1.0.38 or later and UniFi Play Audio Port to version 1.1.9 or later. These updates contain fixes for the improper access control vulnerability. No other mitigations are specified or required.