CVE-2026-102298 Details
Description
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.
A vulnerability exists in the TP-Link Omada Controller when operating in MSP mode. The issue arises because the user-confirmation endpoint does not properly enforce permission checks. This flaw allows an authenticated user to manipulate the Identifier parameter to validate credentials for other accounts. The responses received can indicate whether a user exists, if a password is invalid, or if authentication was successful. Exploiting this vulnerability could lead to user enumeration, unauthorized credential verification, and access to MSP resources, potentially compromising targeted accounts.
Users are advised to update to version 6.3.0.45, available for download from the Omada Network Support website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.omadanetworks.com/en/download/software/omada-controller/ | TPLink | ProductVendor |
| https://support.omadanetworks.com/us/document/136187/ | TPLink | AdvisoryRemedyVendor |
| https://support.omadanetworks.com/us/download/software/omada-controller/ | TPLink | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | TPLink |
| CWE-862 | Missing Authorization | TPLink |
Affected Products
| Product | Versions |
|---|---|
| TP-Link Omada Controller | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | TPLink |