CVE-2026-109506 Improper Authentication in Multiple TP-Link WiFi Repeaters

Medium 5.9 Published 14 Oct 2026 Updated 15 Oct 2026

An attacker on the local network can bypass authentication on TP-Link repeaters by deriving credentials from captured HTTP traffic, gaining admin access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-109506?

CVE-2026-109506 is a medium-severity authentication bypass vulnerability in TP-Link Systems Inc. RE190 v5, published on 14 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture the network traffic associated with legitimate administrator login may be able to derive an alternative credential value that produces the same accepted authentication result and use it to authenticate to the device’s web-management interface with administrator privileges. Exploitation requires the management login to use HTTP and the attacker to observe the session key, dictionary, and login value associated with a legitimate administrator login.

Successful exploitation may allow an unauthenticated adjacent attacker to gain administrator access to the affected device and modify exposed configuration settings.

Weakness: CWE-287

Which versions are affected by CVE-2026-109506?

How do I fix CVE-2026-109506?

No fix has been published for CVE-2026-109506 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-109506 being exploited?

There is no known exploitation of CVE-2026-109506 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-v8j9-72vh-g46g.