TP-Link patched a Kasa authentication flaw, and updating can cost you local control
TP-Link patched a high-severity Kasa authentication flaw, but the firmware fix can break Home Assistant local control until you flip Third-Party Compatibility.
On this page
TP-Link published a security advisory on October 14, 2026 for CVE-2026-108473, an authentication flaw in the local management protocol used by a long list of Kasa plugs, switches and bulbs. One of the named devices is hardware I’ve written up: the Kasa KS220M dimmer switch.
Short version: this is a real bug, scored 8.7 out of 10 by TP-Link’s own CVSS rating, and the fix for the KS220M shipped as firmware a year and a half ago, so most people who let the Kasa app auto-update are already covered. The complication is separate from the bug itself: Home Assistant’s own integration docs warn that newer Kasa firmware needs a “Third-Party Compatibility” switch flipped in the Kasa app or local control stops working, and a TP-Link community thread shows exactly that happening on a KS220M running the fixed firmware version. I haven’t run either Kasa product named here; this is a research piece built from TP-Link’s advisory, Home Assistant’s docs, and the public reports below.
What TP-Link disclosed
The advisory describes an “improper authentication vulnerability in the local device-management protocol” on multiple Kasa devices. In practice: someone else on the same network, with no credentials at all, could send that device management commands and change its settings. TP-Link separately notes that account-related traffic between the app, the device and TP-Link’s cloud can expose account information under some conditions, which it says could in some cases lead to a compromised cloud account.
TP-Link’s table lists 23 device and hardware-version combinations with the firmware version that fixes each one. Two from that table matter here:
| Device | Hardware | Fixed firmware | In the catalog |
|---|---|---|---|
| ES20M & KS220M | V1 | 1.1.6 Build 250522 | Kasa KS220M dimmer switch |
| KP303 | V2 | 1.1.2 Build 241220 | no, named in the forum report below |
The build number in 1.1.6 Build 250522 reads as May 22, 2025. That’s the date the fix firmware actually shipped; TP-Link is disclosing the vulnerability now, about a year and a half later. If your KS220M has taken its automatic updates since mid-2025, it’s already on or past the fixed version.
The Kasa KP125M plug, which I also list, does not appear anywhere on TP-Link’s advisory page. That’s the full extent of what I can say about it: not named, not cleared, because TP-Link’s page doesn’t make a claim either way for that model.
What stays local, what doesn’t
The authentication bug itself
Nothing about this changes how either device is described here. The KS220M already runs through Home Assistant’s local tplink integration (local polling, not Matter), and the vulnerability is in that same local protocol, not in anything cloud-based. Patching it is a straightforward firmware update through the Kasa app (some of these models also show up in the Tapo app, which is where the forum poster above was running theirs).
The side effect nobody mentions on the advisory page
Home Assistant’s own TP-Link integration docs carry a standing warning: “Some firmware versions require explicit activation of third-party integrations before they allow access from Home Assistant,” with the fix being Settings > Third-Party Compatibility in the Kasa app. The docs also note that newer Kasa devices need your TP-Link cloud account credentials to authenticate even a purely local session, so “local” here means the traffic stays on your network, not that a TP-Link account is optional.
A TP-Link community thread from October 2025 shows this happening on the exact device named in the new advisory: a user’s KS220M, on firmware 1.1.6, the same version TP-Link’s table now lists as the CVE fix, stopped responding to Home Assistant while still working from the Tapo app. A TP-Link staff reply said plainly that Home Assistant isn’t an officially supported third-party platform, that TP-Link makes no guarantee about it, and pointed at the Third-Party Compatibility switch as the available workaround. The original poster flipped it, restarted the device and Home Assistant, and got control back. A second user in the same thread said the switch didn’t fix an HS300 running a different firmware version, so it isn’t a guaranteed fix.
A separate, closed GitHub issue from September 2026 describes the same pattern on a KP125M, on a different firmware number (1.4.1), resolved only by the same toggle. Home Assistant’s maintainers used that report to make their own docs clearer across Kasa and Tapo devices, not to change any code.
None of this proves the CVE fix is what breaks Home Assistant. It shows the same firmware family has carried this requirement for over a year, and that it’s easy to update a Kasa device for the CVE and then wonder why Home Assistant stopped seeing it.
Buy, wait or ignore
Home Assistant house that already owns a KS220M. Update it (the Kasa app will push 1.1.6 or later if it hasn’t already) for the security fix, then open the Kasa app’s Settings and confirm Third-Party Compatibility is on before you assume Home Assistant is broken. Nothing here is a reason to pull the switch out of the wall.
Home Assistant house shopping for a Wi-Fi dimmer or plug. This doesn’t move the KS220M or KP125M off or onto the list. It’s a reason to check Third-Party Compatibility on any Kasa device the first time you set it up, not just after something stops working.
Budget buyer who just wants it to work with Alexa or Google Home. This advisory doesn’t touch you. The vulnerability is about the local management protocol that Home Assistant and similar tools use; the Kasa app, Alexa and Google Home go through TP-Link’s own supported path.
Does this change my picks?
Not the picks themselves.
- Kasa KS220M dimmer switch. The product page’s last compatibility check predates this advisory. It’s worth a refresh pass to note the fixed firmware version and the Third-Party Compatibility requirement, but the pick itself, a Wi-Fi dimmer with a built-in motion sensor, is unchanged.
- Kasa KP125M plug and the three guides that recommend it (budget smart home gifts, products under fifty dollars, smart plugs for PC power monitoring). It isn’t named in TP-Link’s advisory at all, so there’s nothing to act on yet. I’ll revisit if TP-Link adds it to the list.
Sources
- TP-Link Security Advisory, FAQ 5342: Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices (CVE-2026-108473)
- OpenCVE record for CVE-2026-108473
- Home Assistant docs: TP-Link Smart Home integration
- TP-Link community forum: Local control lost after firmware update on KP303 (v2.0) and KS220M (v1.0)
- GitHub, home-assistant/home-assistant.io issue #48218: Kasa KP125M firmware 1.4.1 breaks local control in Home Assistant
- Kasa Smart product page: Smart Wi-Fi Dimmer Switch KS220M
- TP-Link FAQ 1256: How to Update Kasa Device Firmware via the Kasa App
Every fact above comes from these sources, checked Oct 18, 2026. A launch brief is written before hands-on testing; the "what I verified" box says what is confirmed and what is not.