CVE-2026-15315 describes an improper authentication vulnerability (CWE-287) in TP-Link Tapo C120 v1 and C200 v5 devices. The issue resides in the login authentication verification module, where an attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls. This bypass allows the attacker to obtain administrative session tokens, which can be used to perform privileged management actions, gain unauthorized administrative access, and cause temporary denial-of-service conditions by disrupting device services.

An attacker with local network access can bypass authentication to obtain administrative session tokens. This enables unauthorized privileged management actions, unauthorized administrative access, and can cause temporary denial-of-service by disrupting device services. The vulnerability has a high severity score (CVSS 8.7) indicating significant impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict local network access to the affected devices to trusted users only.