CVE-2026-105822 Server-Side Request Forgery in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT proxy contains a server-side request forgery SSRF vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server...

CVE-2026-105822

The Tapo Cloud MQTT proxy is susceptible to a Server-Side Request Forgery (SSRF) vulnerability because it fails to perform sufficient input validation on user-controlled host values. An attacker can exploit this flaw to force the Tapo Cloud service to send requests to an attacker-controlled serve...

EUVD-2026-116271

The Tapo Cloud MQTT proxy contains a server-side request forgery SSRF vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud service to send requests to an attacker-controlled server...

EUVD-2026-116270

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo devic...

CVE-2026-105821 Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo devic...

CVE-2026-105821

The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated devices to request service tokens. The root cause is that the broker fails to verify if the device ID provided in a proxy request matches the authenticated device. An attacker owning a...