CVE-2026-15315 is an improper authentication vulnerability (CWE-287) in the TP-Link Tapo C200 v5 camera. The vulnerability arises from weaknesses in the challenge parameter validation during login authentication. An attacker with local network access can exploit this to bypass normal authentication mechanisms and acquire administrative session tokens. Successful exploitation enables the attacker to perform privileged management actions, gain unauthorized administrative access, and cause temporary disruption of device services resulting in denial-of-service.

Exploitation allows an attacker on the local network to bypass authentication and obtain administrative session tokens. This leads to unauthorized administrative access, the ability to execute privileged management functions, and potential temporary denial-of-service conditions on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by TP-Link Systems Inc. at this time.