Authentication Bypass Vulnerability in TP-Link Tapo C520WS Router

CVE-2026-34121

What is CVE-2026-34121?

An authentication bypass vulnerability has been identified in the HTTP handling of the DS configuration service of the TP-Link Tapo C520WS v2.6. This flaw arises from inconsistent parsing and authorization logic in JSON requests during the authentication process. Consequently, an unauthenticated attacker can exploit this vulnerability by appending an action exempt from authentication to requests containing privileged DS operations. This allows them to bypass crucial authorization checks, leading to the potential execution of restricted configuration actions and unauthorized modifications of the device's state.

References