# CVE-2026-105672: TP-Link Tapo C325WB V2 authorization bypass in JSON API

Source: https://junglewise.ai/threats/cve-2026-105672-tp-link-tapo-c325wb-v2-contains-an-unauthenticated-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105672 · Severity: info · Published 2026-10-08

TP-Link Tapo C325WB V2 is an outdoor security camera that streams video and stores recordings. An unauthenticated attacker on the same local network can bypass the camera's session verification by manipulating JSON API requests, gaining unauthorized access to live video and audio feeds. An attacker exploiting this vulnerability could also modify camera settings and extract sensitive device information or credentials.

Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-105672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105672 being exploited in the wild.

**How severe is CVE-2026-105672?** Informational severity, published 8 October 2026.

**Which products and versions are affected?** TP-Link Tapo C325WB V2 V2.

**Is there a fix for CVE-2026-105672?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105672 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-105672?** Check whether you run TP-Link Tapo C325WB V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the HTTPS JSON API dispatcher (port 443) of the Tapo C325WB V2. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification, allowing them to invoke privileged API actions without authentication. Successful exploitation grants access to live video and audio streams, device configuration, and sensitive secrets.

## Affected products

- TP-Link Tapo C325WB V2 V2

## Timeline

- 2026-10-08: disclosed

## References

- [https://www.tp-link.com/en/support/download/tapo-c325wb/](https://www.tp-link.com/en/support/download/tapo-c325wb/)
- [https://www.tp-link.com/us/support/download/tapo-c325wb/](https://www.tp-link.com/us/support/download/tapo-c325wb/)