CVE-2026-75907 CVE-2026-75907
Attackers can clone NFC credentials to bypass door access controls because the system relies on static, unencrypted UIDs instead of secure authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75907?
CVE-2026-75907 is a high-severity authentication bypass vulnerability in Norwegian Cruise Line door access control, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.
Which versions are affected by CVE-2026-75907?
How do I fix CVE-2026-75907?
No fix has been published for CVE-2026-75907 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-75907 being exploited?
There is no known exploitation of CVE-2026-75907 in the wild and no public exploit code.
Sources
Also known as GHSA-x9r9-43q5-jgwv.