CVE-2026-71277
CriticalCVSS 9.1Summary
The AuthToken request-guard implementation in rust-iot-platform only checks whether the Authorization HTTP header is present, never validating its value. Any request with an arbitrary non-empty Authorization header (e.g. 'Authorization: fake') satisfies the guard, granting access to all protected endpoints.
Risk Assessment
An attacker can gain unauthorized access to all protected platform functions, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately implement proper authentication token validation, checking against session or token store.
Original NVD description (English source)
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. `Authorization: fake`) satisfies the guard, granting access to every endpoint protected only by this request guard.