Description

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-26T11:16:38.807Z",
  "pubdate": "2026-08-26T11:16:38.807Z",
  "executiveSummary": "This vulnerability involves an Improper Neutralization of CRLF Sequences (CWE-113) within UniFi OS, which may allow an authenticated or unauthenticated attacker with network access to manipulate HTTP headers.\nBy successfully injecting Carriage Return (CR) and Line Feed (LF) characters into input processed by the UniFi OS web interface, an attacker can conduct HTTP Response Splitting or Header Injection.\nThe primary security implication is the potential for authentication bypass, enabling unauthorized access to the device or management instance.\nExploitation requires network-level proximity to the target UniFi OS device and specific conditions within the application's request processing logic.\nThis flaw represents a significant risk to device integrity, as it facilitates the subversion of session management or security controls implemented via HTTP headers.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the UniFi OS web service to sanitize user-supplied input before incorporating it into HTTP headers. When an application reflects unsanitized input containing CRLF sequences, it allows for the termination of the current header block and the injection of arbitrary additional headers or, in some cases, the initiation of a completely new HTTP response body.\nThe attack flow begins with the adversary crafting a malicious request directed at a vulnerable UniFi OS endpoint. By injecting hex-encoded CRLF characters (e.g., %0d%0a) into a parameter that is subsequently reflected in a server response header, the attacker forces the server to interpret the injected characters as control sequences rather than literal data.\nIn the context of authentication bypass, an attacker may exploit this to manipulate security-related headers, such as session cookies or authorization tokens. For example, by splitting the response, an attacker could inject a 'Set-Cookie' header to force a browser to store a specific session identifier, effectively hijacking or pre-setting an authentication context. Alternatively, the attacker may inject a response that appears to originate from the server but contains a malicious payload, potentially leading to Cross-Site Scripting (XSS) if the injected content is rendered by the user's browser.\nThe vulnerable component is the underlying HTTP processing engine utilized by UniFi OS for managing administrative web traffic. Because the web server processes these inputs without strict filtering, the integrity of the HTTP transaction is compromised. Successful exploitation essentially permits the attacker to 'split' the HTTP response, allowing them to control the structure of the data returned to the client or the server's internal state regarding the session.\nGiven that this vulnerability affects UniFi OS, any network-exposed instance is susceptible to exploitation provided the attacker can reach the web management interface. No prior authentication is strictly required if the CRLF injection point exists in an unauthenticated endpoint or header parsing routine. Once successfully exploited, the impact is severe, granting unauthorized actors the ability to bypass authentication mechanisms, gain administrative control over the UniFi OS instance, or redirect traffic to malicious destinations."
}