ZDI-CAN-28468: ZDI-26-966: (Pwn2Own) Philips Hue Bridge HomeKit Authentication Bypass Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-126981.

Affected Software

1 affected component

Philips Hue Bridge

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker who is network-adjacent to an affected Philips Hue Bridge installation can exploit it. No authentication is required.

Does exploitation require an existing account or prior access?

No. The vulnerability can be exploited without authentication.

ZDI-CAN-28468: ZDI-26-966: (Pwn2Own) Philips Hue Bridge HomeKit Authentication Bypass Vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require an existing account or prior access?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Does exploitation require an existing account or prior access?