---
id: CVE-2026-105814
title: Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
summary: |-
  TP-Link Tapo
  C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API.
  A crafted JSON request containing both a protected operation and public
  onboarding-related fields may cause module-level authorization checks to …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: TP-Link Systems Inc.
product: Tapo C210 v3.6
affected:
  - tapo_c210_v3.6 < V3.6_1.2.7 Build 260818
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:26:57.630Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105814'
references:
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes
  - url: 'https://www.tp-link.com/us/support/faq/5352/'
tags:
  - cve.org
ingestedAt: '2026-10-19T21:43:56.118Z'
---

## Overview

TP-Link Tapo
C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API.
A crafted JSON request containing both a protected operation and public
onboarding-related fields may cause module-level authorization checks to be
applied inconsistently, allowing protected camera operations, including
pan-tilt-zoom control, to be executed without a valid authenticated
session. 





Successful
exploitation may allow an unauthenticated attacker on the adjacent network to
perform protected camera operations, including pan-tilt-zoom (PTZ) control,
without a valid authenticated session. This could result in unauthorized
manipulation of camera functionality.

## Affected

- `tapo_c210_v3.6 < V3.6_1.2.7 Build 260818`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.