# CVE-2026-34121: TP-Link Tapo C520WS authentication bypass in DS configuration service

Source: https://junglewise.ai/threats/cve-2026-34121-tp-link-tapo-c520ws-authentication-bypass-in-ds-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34121 · Severity: high · CVSS 8.8 · Published 2026-04-02

A security vulnerability has been identified in the TP-Link Tapo C520WS outdoor security camera. This flaw allows an unauthorized person on the same network to bypass security checks and change the camera's settings. This could lead to unauthorized access to the device, modification of its configuration, or a loss of control over the security camera's operations.

Technologies: [TP-Link Tapo C520WS](https://junglewise.ai/threats/technologies/tapo-c520ws), [TP-Link Tapo C520ws Firmware](https://junglewise.ai/threats/technologies/tapo-c520ws-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-34121 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34121 being exploited in the wild.

**How severe is CVE-2026-34121?** High severity, with a CVSS score of 8.8, published 2 April 2026.

**Which products and versions are affected?** TP-Link Tapo C520WS before 1.2.4 Build 260326 Rel.24666n.

**Is there a fix for CVE-2026-34121?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-34121 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-34121?** Check whether you run TP-Link Tapo C520WS or TP-Link Tapo C520ws Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in the DS configuration service of TP-Link Tapo C520WS v2.6. The flaw is caused by inconsistent parsing and authorization logic when handling JSON requests during authentication checks. Specifically, an unauthenticated attacker can craft a request that appends an authentication-exempt action alongside privileged 'DS do' actions. This allows the attacker to bypass authorization checks and execute restricted configuration commands. The vulnerability is reachable via the local network (adjacent) and requires no user interaction. TP-Link has released firmware version 1.2.4 Build 260326 Rel.24666n to address this issue.

## Affected products

- TP-Link Tapo C520WS v2.6 before 1.2.4 Build 260326 Rel.24666n

## Timeline

- 2026-04-02: disclosed
- 2026-04-02: advisory

## References

- [https://www.tp-link.com/en/support/download/tapo-c520ws/](https://www.tp-link.com/en/support/download/tapo-c520ws/)
- [https://www.tp-link.com/us/support/download/tapo-c520ws/](https://www.tp-link.com/us/support/download/tapo-c520ws/)
- [https://www.tp-link.com/us/support/faq/5047/](https://www.tp-link.com/us/support/faq/5047/)

## Related threats

- [TP-Link Tapo C520WS format string vulnerability in ONVIF Subscribe service](https://junglewise.ai/threats/cve-2026-6242-tp-link-tapo-c520ws-format-string-vulnerability-in-onvif-subscribe)
- [TP-Link Tapo C520WS format string vulnerability in ONVIF AddScopes](https://junglewise.ai/threats/cve-2026-6241-tp-link-tapo-c520ws-format-string-vulnerability-in-onvif-addscopes)
- [TP-Link Tapo C520WS stack overflow in ONVIF DeleteUsers service](https://junglewise.ai/threats/cve-2026-6240-tp-link-tapo-c520ws-stack-overflow-in-onvif-deleteusers-service)
- [TP-Link Tapo C520WS stack buffer overflow in ONVIF CreateUsers service](https://junglewise.ai/threats/cve-2026-6239-tp-link-tapo-c520ws-stack-buffer-overflow-in-onvif-createusers)
- [TP-Link Tapo C520WS auth bypass in API authorization mechanism](https://junglewise.ai/threats/cve-2026-34123-tp-link-tapo-c520ws-auth-bypass-in-api-authorization-mechanism)