CVE-2026-3559 - Vulnerability Analysis

Overview

Philips Hue Bridge contains an authentication bypass caused by static nonce usage in the HomeKit Accessory Protocol SRP authentication mechanism on TCP port 8080, letting network-adjacent attackers bypass authentication without credentials.

Severity & Score

Impact

Network-adjacent attackers can bypass authentication, potentially gaining unauthorized access to the device.

Mitigation

Update to the latest version that addresses the static nonce issue in the HomeKit Accessory Protocol.

References

• https://www.zerodayinitiative.com/advisories/ZDI-26-157/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner