TP-Link Patches Authentication Bypass Flaw in Tapo C200 Smart Cameras

A network-connected security camera only functions as a security device if its video feed remains strictly inaccessible to anyone lacking the correct credentials. That fundamental constraint failed in one of the market's most popular budget indoor cameras, the TP-Link Tapo C200, after researchers discovered a high-severity authentication bypass vulnerability.[1][3]

Researchers at the cybersecurity firm HackYourMom disclosed the zero-day flaw on September 16, 2026, revealing that an attacker could gain unauthenticated administrative access to the hardware. By exploiting a weakness in how the camera handles session tokens, a malicious actor could bypass the login screen entirely and access the 1080p video stream.[1][2]

Once inside, the intruder would possess the exact same privileges as the device owner, including viewing the live video stream, rotating the lens, and disabling the device entirely. While the initial technical disclosures from researchers do not include direct statements from TP-Link executives, the consensus across the security community emphasizes the severity of the unauthenticated access.[2][3]

The Tapo C200 is a ubiquitous piece of smart home hardware, frequently retailing for under $30 and widely deployed as a baby monitor or pet camera. It features a 360-degree horizontal pan and a 114-degree vertical tilt, mechanical movements that an attacker exploiting this flaw could trigger remotely to survey a room, alongside accessing up to 128 GB of local microSD storage.[3][4]

The technical mechanism centers on the camera's local web server, which failed to properly validate the length and structure of authentication requests. According to Rewterz, the vulnerability carries a high-severity designation because it requires zero user interaction and bypasses the primary security boundary protecting the device's 2.4 GHz Wi-Fi connection.[5]

Despite the severity of the access granted, the actual threat model is narrower than some initial alerts suggested. The exploit requires the attacker to already have access to the same local network as the camera, or for the camera to be explicitly exposed to the public internet via port forwarding. It is not a remote-code execution flaw that allows anyone on the internet to arbitrarily scan and compromise devices behind a standard home router.[3][4]

TP-Link has acknowledged the vulnerability and pushed a firmware update to address the authentication loophole, though the company did not provide direct public commentary or executive statements in the initial disclosure reports. Owners are required to open the Tapo mobile application and navigate to the device settings to initiate the download, as the cameras do not always apply critical security patches automatically by default.[1][4]

The incident highlights a persistent structural issue in the smart home market: the rush to produce highly capable, inexpensive hardware often leaves software validation trailing behind. Until manufacturers mandate automatic, silent security updates for all internet-of-things devices, the burden of maintaining the digital perimeter remains entirely on the consumer's willingness to check an app for updates.[2][5]