Vulnerability · Published Apr 2, 2026 · Assigned by TPLink

CVE-2026-34121Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210

High 8.7

In plain English

A high-severity improper authentication in Tapo C210 v3.6 from TP Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C520WS v2.6	0 – before 1.2.4 Build 260326 Rel.24666n
TP Link Systems Inc.	Tapo C210 v3.6	0 – before 1.2.7 Build 260818 Rel.64715n

Weakness: CWE-287 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References