Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-82452

rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Iot-ecology
Products
Rust-iot-platform
CVE-2026-82453

rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Iot-ecology
Products
Rust-iot-platform
CVE-2026-71278

rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Iot-ecology
Products
Rust-iot-platform
CVE-2026-71277

rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Iot-ecology
Products
Rust-iot-platform