Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.