CVE-2021-22957

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-24 · updated 2026-06-17
Weakness: CWE-16

Description

A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect application Version 1.20.0 and later.

Affected products

Ubiquiti Inc UniFi Protect Application: before 1.20.0 — fixed in 1.20.0

How to fix

Upgrade to a fixed version: Ubiquiti Inc UniFi Protect Application 1.20.0. Check the vendor advisory for mitigations.

References

https://community.ui.com/releases/Security-Advisory-Bulletin-021-021/62bd8841-6603-4fee-9dba-73037148f173
https://community.ui.com/releases/Security-Advisory-Bulletin-021-021/62bd8841-6603-4fee-9dba-73037148f173

Get alerted when CVE-2021-22957 or the next vulnerability affects your stack