# CVE-2026-55727: Genetec Security Center authentication bypass in video stream requests

Source: https://junglewise.ai/threats/cve-2026-55727-genetec-security-center-authentication-bypass-in-video-stream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-55727 · Severity: high · CVSS 7.5 · Published 2026-07-06

A security flaw in Genetec Security Center, a unified security platform used for video surveillance and access control, allows unauthorized individuals to view live video feeds. An attacker could exploit this weakness over the network without needing a username or password. This could lead to significant privacy breaches and the unauthorized monitoring of sensitive facilities or operations.

Technologies: [Genetec Security Center](https://junglewise.ai/threats/technologies/security-center). Vendors: [Genetec](https://junglewise.ai/threats/vendors/genetec).

## Quick answers

**Is CVE-2026-55727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55727 being exploited in the wild.

**How severe is CVE-2026-55727?** High severity, with a CVSS score of 7.5, published 6 July 2026.

**Which products and versions are affected?** Genetec Security Center 5.14.0.0 build 5.14.178.8 up to (but not including) 5.14.178.18.

**Is there a fix for CVE-2026-55727?** A patch was published on 2026-07-06: Mandatory hotfix 5.14.178.18 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55727 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55727?** Check whether you run Genetec Security Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in the video retrieval services of Genetec Security Center 5.14.0.0. The flaw stems from a failure in the validation logic for video stream requests, resulting in incomplete verification of client authentication tokens. A remote, unauthenticated attacker can exploit this by sending specially crafted requests to the video management service to retrieve live video content. While video encryption (fusion stream) can mitigate the impact by preventing playback, the underlying authentication bypass remains present until the mandatory hotfix (build 5.14.178.18) is applied.

## Affected products

- Genetec Security Center 5.14.0.0 build 5.14.178.8 up to (but not including) 5.14.178.18

## Timeline

- 2026-07-06: disclosed
- 2026-07-06: advisory
- 2026-07-06: patched: Mandatory hotfix 5.14.178.18 released

## References

- [https://resources.genetec.com/security-advisories/vulnerability-affecting-live-video-retrieval-in-security-center-5-14-0-0](https://resources.genetec.com/security-advisories/vulnerability-affecting-live-video-retrieval-in-security-center-5-14-0-0)

## Related threats

- [Genetec Security Center authorization bypass in Media Gateway API](https://junglewise.ai/threats/cve-2026-65422-a-flaw-in-the-authorization-mechanism-for-media-gateway-api-in)
- [Genetec Security Center information disclosure in installation logs](https://junglewise.ai/threats/cve-2026-40619-genetec-security-center-information-disclosure-in-installation)
- [Genetec Security Center SQL injection in Access Manager](https://junglewise.ai/threats/cve-2026-27768-genetec-security-center-sql-injection-in-access-manager)