A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

CVE-2026-77549 is a vulnerability affecting devices running UniFi OS, involving Improper Neutralization of CRLF Sequences. A malicious actor with network access can exploit this flaw under certain conditions to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which can allow unauthorized access to network infrastructure managed by UniFi OS. The issue has been disclosed via the NVD and Ubiquiti's security advisory bulletin. No additional technical details or proof-of-concept exploits are provided in the article, but the severity is rated High. Organizations using UniFi OS devices should review the advisory and apply any available patches or mitigations promptly. The vulnerability underscores the risk of CRLF injection flaws in network device firmware and operating systems.