CVE-2026-102298: Insufficient Authorization and User Boundary Validation in Omada Controller MSP

Severity: high (CVSS 7.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-639

Description

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication. Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

Affected products

TP-Link System Inc. Omada Software Controller (Windows): before 6.3.0.45 — fixed in 6.3.0.45

How to fix

Upgrade to a fixed version: TP-Link System Inc. Omada Software Controller (Windows) 6.3.0.45. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-102298 or the next vulnerability affects your stack