What is CVE-2026-73669?

CVE-2026-73669 is a medium-severity vulnerability in Signify Philips Hue Bridge Pro, classified under Missing Authentication for Critical Function. CVSS score: 6.3/10. Published 2026-08-13.

How severe is CVE-2026-73669?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Auth bypass in Signify Philips Hue Bridge Pro

CVE-2026-73669

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and control connected lights.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Signify Philips Hue Bridge Pro — versions 0, 1.77.2071318010

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

9119a7d8-5eab-497f-8521-727c672e3725
9119a7d8-5eab-497f-8521-727c672e3725 (release-notes)
9119a7d8-5eab-497f-8521-727c672e3725 (vdb-entry)
9119a7d8-5eab-497f-8521-727c672e3725 (third-party-advisory)

Frequently asked questions

What is CVE-2026-73669?: CVE-2026-73669 is a medium-severity vulnerability in Signify Philips Hue Bridge Pro, classified under Missing Authentication for Critical Function. CVSS score: 6.3/10. Published 2026-08-13.
How severe is CVE-2026-73669?: Medium severity. CVSS v3 base score is 6.3 out of 10.