Auth bypass in TP-Link Tapo C520ws
CVE-2026-34121
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
Vulnerability class: Broken Authentication
EPSS: 0.004 (37.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tp-link Tapo_c520ws — versions 2.6
- Tp-link Tapo_c520ws_firmware
- Tp-link Systems Inc. Tapo C520ws V2.6 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Release Notes, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Release Notes, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-34121?
- CVE-2026-34121 is a high-severity vulnerability in TP-Link Tapo C520ws, classified under Improper Authentication. CVSS score: 8.8/10. Published 2026-04-02.
- How severe is CVE-2026-34121?
- High severity. CVSS v3 base score is 8.8 out of 10.