Omada Controller Vulnerability in User-Confirmation Endpoint
CVE-2026-102298

7.5HIGH

Key Information:

Vendor: Tp-link System Inc.
Status: Omada Software Controller (windows)
Vendor: CVE Published:; 14 October 2026

🔔 Create Tp-link System Inc. Vulnerability Alert

What is CVE-2026-102298?

In the Omada Controller’s MSP mode, the user-confirmation endpoint lacks proper permission checks, allowing an authenticated user to manipulate the Identifier parameter. This flaw can lead to user enumeration, enabling attackers to verify credentials across accounts and potentially gain unauthorized access to MSP resources. Exploitation can compromise targeted accounts, emphasizing the importance of patching this vulnerability promptly.