Security Advisory catalog CVE-2026-84941
cve-program · CVE-2026-84941 Published
An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could result in unauthorized disclosure of sensitive information.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-84941 Published Omada Software Controller (Windows) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "Omada Software Controller (Windows)",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.2.14.11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Omada Software Controller (Linux) Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "Omada Software Controller (Linux)",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "6.2.14.11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC2000 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC2000 v1",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.41.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC2000 v2 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC2000 v2",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.26.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC200 v3 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC200 v3",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.3.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC220 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC220 v1",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.6.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC220 v2 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC220 v2",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.5.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC300 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC300 v1",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.35.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} OC400 v1 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "TP-Link Systems Inc.",
"product": "OC400 v1",
"platforms": [
"Omada Controller"
],
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.13.11 Build 20260711",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
} Original source record · Cite this exact observation · Complete original publisher JSON