CVE-2026-3562CWE-347

Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability

Medium · published March 13, 2026

CVSS v3.0
6.3
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ed25519_sign_open function. The issue results from improper verification of a cryptographic signature. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28480.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-03-13T20:37Z
EPSS history
Timeline
  • 13 MAR 20:37Z
    Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability
    cvelistv5