Authentication Bypass in Philips Hue Bridge by Philips

CVE-2026-3559

What is CVE-2026-3559?

A significant vulnerability found in the Philips Hue Bridge allows network-adjacent attackers to bypass authentication mechanisms. This flaw resides in the SRP authentication configuration used within the HomeKit Accessory Protocol service. Exploiting this vulnerability, which is compounded by a static nonce value, enables attackers to gain unauthorized access to the device without the need for authentication. The HomeKit Accessory Protocol typically listens on TCP port 8080, creating an avenue for exploitation. This presents serious security implications for users' connected home environments.

References