CVE-2026-71277

15th percentile - higher than 15% of all known CVEs

In rust-iot-platform, the AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.

An attacker can gain access to protected resources without a valid token, potentially leading to unauthorized access to data and system functions.

Implement proper token validation, checking its validity, signature, and session association. Also, use standard authentication mechanisms such as JWT with signature verification.