CVE-2026-102298: CWE-639 Authorization bypass through User-Controlled key in TP-Link System Inc. Omada Software Controller (Windows)

The vulnerability exists in the Omada Controller MSP mode where the user-confirmation endpoint fails to enforce required permission checks. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that differentiate between nonexistent users, invalid passwords, and successful authentication. This flaw enables user enumeration, credential verification, and unauthorized access to MSP resources or targeted accounts. The CVSS 4.0 score is 7.5 (high severity) with network attack vector, low attack complexity, and requires high privileges but no user interaction.

Successful exploitation allows an authenticated user to bypass authorization controls, enumerate valid users, verify credentials, and potentially gain unauthorized access to managed service provider (MSP) resources or compromise targeted accounts within the Omada Software Controller environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the MSP mode endpoints to trusted users only and monitor for suspicious activity related to user-confirmation requests.