Auth bypass in Tp-link Systems Inc. Tapo C520ws V2.6
CVE-2026-34121
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check…
Vulnerability class: Broken Authentication
EPSS: 0.001 (31.0th percentile) — read the EPSS interpretation.
Affected products
- Tp-link Systems Inc. Tapo C520ws V2.6 — versions 0
Weakness classification (CWE)
References
- www.tp-link.com/us/support/download/tapo-c520ws/ (patch)
- www.tp-link.com/en/support/download/tapo-c520ws/ (patch)
- www.tp-link.com/us/support/faq/5047/ (vendor-advisory)