UniFi OS Authentication Gateway Bypass Attempt

Ethan Andrews@eandrews

•updated Jun 9, 2026•1•0•5

Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.