A Server‑Side Request Forgery flaw in Ubiquiti Inc. UniFi Talk Application allows an attacker with network access to request arbitrary URLs from the controller. This can exhaust internal resources, trigger a Denial of Service, and bypass authentication checks on certain API endpoints, rendering the service unavailable or accessible without credentials.

All installations of Ubiquiti Inc. UniFi Talk Application that have not yet applied the vendor’s security patch are affected. No specific version numbers are disclosed in the advisory, so every current release remains at risk until the update is applied.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, implying no publicly known active exploits. The likely attack vector involves an entity that can reach the UniFi Talk API—such as an internal actor or a compromised device—that then abuses the SSRF capability to access external resources, producing the denial of service and authentication bypass impact.