---
id: "CVE-2026-122044"
page: "https://infrastack.ai/live/CVE-2026-122044"
kind: "vulnerability"
aliases: ["CVE-2026-122044"]
title: "Philips Hue Bridge Pro: network attacker bypasses authentication on HTTP service"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Philips Hue Bridge Pro", "fixed": ["6.1.2071524030"], "affected": "< 6.1.2071524030", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "iot", "network-appliance", "philips-hue", "smart-lighting"]
not_affected_if: ["isolated-network", "no-hue-bridge-pro", "patched-firmware"]
published_at: "2026-11-12T03:17:11+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:48:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122044", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-892/", "first_seen_at": "2026-11-12T03:48:45+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-892/", "https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root", "https://www.philips-hue.com/en-us/support/release-notes/bridge-pro"]}]
exploit_sources: []
---

# Philips Hue Bridge Pro: network attacker bypasses authentication on HTTP service

Link for people: https://infrastack.ai/live/CVE-2026-122044 (this .md is for agents)

A flaw in the HTTPS service (TCP 443) of the Philips Hue Bridge Pro lets an attacker on the same network bypass authentication with no credentials (CVSS 8.8, per ZDI). Fixed in firmware 6.1.2071524030.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Philips Hue Bridge Pro affected < 6.1.2071524030 fixed 6.1.2071524030

## How to check

In the Hue app open Settings > Software update (or the bridge info) and read the Bridge Pro software version; versions below 6.1.2071524030 are exposed. Also check that TCP 443 on the bridge is not reachable from guest Wi-Fi or other untrusted segments.

## Fix

Update Bridge Pro firmware to 6.1.2071524030 or later (6.3.2071556020 is the current build): Hue app > Settings > Software update, and turn on Automatic update.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122044
- 2026-11-12T03:48:45+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-892/ — ZDI-26-892 (Nov 6 2026) names fix firmware 6.1.2071524030 or later; vendor release notes list that build (Sep 24) and newer 6.3.2071556020 (Oct 22). Release notes don't mention the security fix, ZDI is not the vendor, so nothing marked verified. Affected lower bound not stated. No exploitation or PoC reported.

## Documents

- [advisory] ZDI-26-892 Philips Hue Bridge Pro auth bypass https://www.zerodayinitiative.com/advisories/ZDI-26-892/
- [describes] Soth.pl: Hue Bridge Pro ZDI advisories https://en.soth.pl/news/philips-hue-bridge-pro-zdi-publishes-auth-bypass-and-sql-injection-that-can-reach-root
- [fix] Hue Bridge Pro release notes https://www.philips-hue.com/en-us/support/release-notes/bridge-pro

## From the sources

Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the HTTP service, which listens on TCP port 443 by default. The issue results from the failure to apply a protection mechanism. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-33086.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_