CVE-2026-77550 describes an Improper Neutralization of CRLF Sequences vulnerability affecting devices running Ubiquiti UniFi OS. A malicious actor with network access can exploit this vulnerability to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which carries significant risk as it could allow unauthorized access to network management infrastructure. CRLF injection vulnerabilities occur when an attacker is able to insert carriage return and line feed characters into HTTP headers or other input fields, potentially manipulating application logic. The vulnerability has been assigned a high criticality rating. Ubiquiti has published a security advisory bulletin addressing this issue. Organizations running UniFi OS devices should review the advisory and apply any available patches or mitigations promptly to prevent unauthorized access to their network infrastructure.
