Norwegian Cruise Line door access controller contains an improper authentication security flaw

What happened

Description Norwegian Cruise Line is a global cruise company that operates a modern fleet sailing to destinations worldwide. As described in CVE-2026-75907 (the public catalogue number for a specific software flaw) , the affected card reader authenticates NFC credentials only by checking their static 7-byte UID.

A UID is not a secret and does not support cryptographic challenge‑response operations, so it cannot serve as a reliable authentication factor. Although the keycard's NTAG212 tag contains a memory block with a printed serial number and a value resembling a signature, the reader does not inspect this data during the access-control process.

Validation based solely on UID constitutes identification rather than authentication. Because the credential performs no cryptographic exchange and offers no defense against cloning, any device capable of replaying or emulating UIDs can reproduce a functioning keycard.

Key facts

• Although the keycard's NTAG212 tag — includes: a memory block with a printed serial number and a value resembling a signature, the reader does not inspect this data during the access-control process