This vulnerability (CVE-2026-54408) in the UniFi Protect Application involves improper access control (CWE-284) that enables an unauthenticated attacker on the network to bypass authentication mechanisms and access data streaming functionality. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, resulting in high confidentiality impact, low integrity impact, and low availability impact. No remediation level or patch information is currently available, and no affected versions have been explicitly stated.

An attacker with network access can bypass authentication controls to stream data from the UniFi Protect Application. This leads to a high confidentiality impact due to unauthorized data access, with limited integrity and availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the UniFi Protect Application to trusted users only and monitor for unauthorized access attempts.