Auth bypass in Tp-link Systems Inc. Tapo C520ws V2

CVE-2026-34123

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization mechanism, an attacker can craft requests that …

Vulnerability class: Broken Authentication

EPSS: 0.002 (4.7th percentile) — read the EPSS interpretation.