CVE-2026-71231
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In IOTSmartHome, the checkCookie function in gui/login.php builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.
Risk Assessment
An attacker can manipulate the lastLogin cookie to bypass authentication and gain access to user accounts, potentially leading to unauthorized system access.
Recommendation
Use parameterized SQL queries and proper validation/sanitization of cookie data before using it in queries. Also, sign cookies to prevent tampering.
Original NVD description (English source)
IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.