Ubiquiti Patches Critical CVSS 10 Flaw in UniFi Access That Exposed Management API Without Authentication

Ubiquiti has patched a critical CVSS 10 flaw in UniFi Access that exposed the management API without authentication. The vulnerability is associated with CVE-2025-52665 and has been described as an authentication bypass. The patch addresses a flaw that allowed unauthenticated access to the UniFi Access management API. The report carrying these details is dated 27 October 2025. The article’s illustration refers to UniFi Access Bypass and CVE-2025-52665.