ZDI 2026-03-06

ZDI-26-157: (Pwn2Own) Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability

CVE-2026-3559

Machine-generated analysis · WAYSCloud LLM

The advisory notes a static nonce in the HomeKit Accessory Protocol can enable authentication bypass on Philips Hue Bridge.

Context

The affected product is the Philips Hue Bridge, specifically related to its HomeKit Accessory Protocol implementation. The vulnerability is an authentication bypass due to a static nonce, exploitable by network-adjacent attackers without requiring authentication. The advisory explicitly states the vulnerability is remotely exploitable over the network. Worth noting the ZDI assigned a CVSS 8.1 rating, indicating high severity per their scoring.

Operator considerations

Check: inventory Philips Hue Bridge devices on the network.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.1. The following CVEs are assigned: CVE-2026-3559.

Read the full advisory on ZDI →

Related advisories