CVE-2026-105821 Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo devic...