Philips Hue Bridge Pro: LAN Authentication Bypass via CVE-2026-122044

On November 6, 2026, the Zero Day Initiative published advisory ZDI-26-892, documenting an authentication bypass vulnerability in the Philips Hue Bridge Pro. Tracked as CVE-2026-122044, the flaw allows an attacker on the same local network to evade access controls on the device's HTTP service without presenting credentials. The report was sent to vendor Signify on August 12, 2026, marking roughly 86 days of coordinated disclosure.

The Mechanism: What Lies Behind Port 443

Advisory ZDI-26-892 pinpoints the attack surface. The bridge's HTTP service listens on TCP port 443 by default. According to the Zero Day Initiative, the issue stems from a "failure to apply a protection mechanism": a security control that should block unauthorized access was not implemented or enabled correctly.

The ZDI does not specify the exact nature of this missing mechanism. What is certain is that its absence allows an attacker to clear the authentication hurdle without presenting any credentials. Port 443, typically associated with HTTPS, here hosts an HTTP service vulnerable to a structural bypass.

"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not required to exploit this vulnerability." — ZDI Advisory ZDI-26-892

The Network-Adjacent Vector: An Underestimated Threat

The term "network-adjacent" in ZDI parlance precisely defines the risk perimeter. The attacker must be on the same local network as the bridge: this is not an attack executable remotely over the internet, nor does it require physical access to the device. This middle ground covers concrete scenarios: an already-compromised device on the LAN, a guest connected to Wi-Fi, malware that has gained a foothold in the network.

The Philips Hue Bridge Pro is a central component of Signify's smart lighting ecosystem. It manages configuration of lamps, scenes, automations, and integrations with third-party platforms. An authentication bypass at this architectural position opens a gap in the internal trust boundary, with potential for lateral movement to other network devices.

From Report to Patch: The Coordination Timeline

The research was conducted by Connor Ford, operating under the handle @ByteInsight within the TrendAI Zero Day Initiative. The vendor notification dates to August 12, 2026. The coordinated advisory release occurred on November 6, 2026, after an interval of roughly 86 days reflecting the standard responsible disclosure process.

During this window, Signify released a specific firmware update. The advisory cites version 6.1.2071524030 or later as the fixed release. The detail matters: this is not a generic fix but a precise numerical reference administrators can verify in their device interface.

Immediate Actions

Philips Hue Bridge Pro users must verify the installed firmware version and ensure it is 6.1.2071524030 or later. The check is available in the bridge management interface, typically accessible via the Philips Hue app or the local web portal.

For devices not yet updated, manually force an update check through the app settings. In segmented network environments, administrators should isolate the bridge in a dedicated VLAN where possible, limiting visibility of the HTTP service on TCP port 443 to authorized devices only.

Priority is highest for bridges exposed on networks with guest access or unmanaged devices: in these scenarios, the network-adjacent condition is met by default and the authentication bypass requires no attacker preparation.

Why This Matters

The ZDI did not publish a CVSS score for this vulnerability, nor did it specify the exact impact achievable after the authentication bypass. No evidence of in-the-wild exploitation or proof-of-concept code release has emerged to date. These disclosure limits do not diminish the intrinsic severity of the flaw: a home-automation control device that accepts administrative connections without authentication represents a weak link in a local network perimeter.

Context amplifies the risk. Philips Hue bridges number in the tens of millions worldwide, often deployed in home settings where network segmentation is practically non-existent and the average user does not actively monitor IoT firmware versions. The combination of massive distribution, non-automatic updates, and low security visibility makes this vulnerability an ideal candidate for large-scale abuse once an attacker gains a foothold in the target network.

The final recommendation is straightforward: verify the firmware, apply the patch, reduce the bridge's exposure surface on the local network. Three simple actions that depend, however, on end-user awareness—the true Achilles' heel of the security chain.

Sources

• zerodayinitiative.com
• zerodayinitiative.com