Philips Hue Bridge Pro Vulnerable to Authentication Bypass
Zero Day Initiative disclosed CVE-2026-122044, a critical authentication bypass vulnerability in Philips Hue Bridge Pro, allowing network-adjacent attackers to gain unauthorized access.
A critical authentication bypass vulnerability has been disclosed for the Philips Hue Bridge Pro, identified as CVE-2026-122044. This flaw, reported by Zero Day Initiative, allows network-adjacent attackers to circumvent authentication mechanisms without requiring any credentials, posing a significant risk to users' smart home networks.
The vulnerability resides within the HTTP service that the Philips Hue Bridge Pro exposes, typically listening on TCP port 443. The root cause is attributed to a failure in implementing a crucial protection mechanism. This oversight enables an attacker to bypass the system's authentication controls, potentially leading to unauthorized access and control over connected smart home devices.
With a CVSS score of 8.8, this vulnerability is classified as high severity. The ability for an attacker to bypass authentication without prior knowledge or credentials makes it a prime target for exploitation. Network-adjacent attackers can leverage this flaw to gain a foothold within a user's local network, potentially leading to further compromise of connected devices and sensitive data.
Philips has addressed this vulnerability by releasing a firmware update. The fix is included in Bridge Pro firmware version 6.1.2071524030 and subsequent releases. Users are strongly advised to update their Philips Hue Bridge Pro firmware to the latest version to mitigate the risk associated with CVE-2026-122044. Release notes can be found on the official Philips Hue support website.
The vulnerability was initially reported to the vendor on August 12, 2026. Following a coordinated disclosure process, Zero Day Initiative publicly released the advisory on November 6, 2026. This timeline ensures that vendors have adequate time to develop and distribute patches before the vulnerability becomes widely known, though the public release itself serves as a call to action for users.
This discovery highlights the ongoing need for robust security practices in the Internet of Things (IoT) and smart home ecosystems. As more devices become interconnected, the attack surface expands, making vulnerabilities like this authentication bypass particularly concerning. The ease of exploitation, requiring only network adjacency and no credentials, underscores the importance of timely patching and vendor security diligence.
The research was conducted by Connor Ford of TrendAI, with Zero Day Initiative facilitating the disclosure. This collaboration between security researchers and vendors is crucial for identifying and remediating vulnerabilities before they can be widely exploited by malicious actors. The disclosure serves as a reminder for consumers and businesses to stay informed about security updates for their smart home devices.
This new advisory, ZDI-26-891, details a SQL injection vulnerability within the Philips Hue Bridge Pro's HTTP service that allows network-adjacent attackers to achieve remote code execution. While the previous advisory (CVE-2026-122044) focused on an authentication bypass, this new vulnerability requires authentication but bypasses existing mechanisms to execute code in the context of root, with a CVSS score of 8.0.