Threats tagged 'ghsa-wfj8-p8xg-8j7g'

An authentication bypass vulnerability exists in the HTTP handling of the DS configuration service in TP-Link Tapo C520WS version 2.6. The flaw arises from inconsistent parsing and authorization logic in JSON requests during authentication checks, allowing an unauthenticated attacker to bypass authorization by appending an authentication-exempt action to privileged requests. Exploitation enables unauthorized execution of restricted configuration actions, potentially modifying the device state without authentication.