What is the CVSS score of CVE-2026-71231?

CVE-2026-71231 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IOTSmartHome are affected by CVE-2026-71231?

IOTSmartHome's login component contains a critical SQL injection vulnerability enabling unauthenticated attackers to bypass authentication and exfiltrate all database contents, including user…

How to fix or mitigate CVE-2026-71231?

Within 24 hours: isolate affected IOTSmartHome instances from production networks or implement emergency WAF rules to block SQL injection patterns in the lastLogin cookie; audit database access logs for unauthorized queries; verify session integrity. Within 7 days: deploy parameterized SQL queries as emergency code remediation in gui/login.php; enforce strict input validation on all cookie values; disable lastLogin cookie authentication and enforce session-only authentication; issue forced password resets for all users; establish continuous monitoring for exploitation attempts. Within 30 days: contact IOTSmartHome vendor for patch timeline; evaluate and execute migration to patched versions when available; conduct comprehensive forensic audit of database access logs across the entire exposure window; implement network segmentation restricting login endpoint access to authorized users only.

IOTSmartHome CVE-2026-71231

EUVD-2026-53304 CRITICAL

SQL Injection (CWE-89)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-hchq-288f-9hjc

PHP SQLi

9.8

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable cookie injection, no auth or interaction (AV:N/AC:L/PR:N/UI:N); full credential read and auth bypass give C:H/I:H, but no described availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:32 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. An unauthenticated attacker can set a lastLogin cookie containing a base64-encoded SQL injection payload (e.g. base64("' OR '1'='1")) to bypass authentication and, via UNION-based injection, extract arbitrary data including user credentials.

Articles & Coverage 1

News Critical Authentication Bypass & SQLi in PHP IOTSmartHome Login - CVE-2026-71231 Aug 06, 2026

AnalysisAI

Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.

Technical ContextAI

The affected code is a PHP web GUI (gui/login.php) backed by a SQL database with a users table keyed on an ID column. The vulnerability is a classic CWE-89 SQL Injection: the checkCookie() routine builds SELECT * FROM users WHERE ID='<value>' where <value> is the base64-decoded lastLogin cookie. Because safe_decode() only reverses URL-safe base64 encoding and applies no escaping, parameterization, or input validation, attacker-controlled SQL metacharacters (quotes, UNION, comments) survive into the query string. The base64 layer is not a security control - it is merely a transport encoding, and it conveniently lets an attacker smuggle characters that might otherwise be filtered or mangled in transit. Reference: the GitHub project at https://github.com/thebradleysanders/IOTSmartHome.

RemediationAI

No vendor-released patch or fixed version is identified at time of analysis. The primary fix is to rewrite checkCookie() to use parameterized queries / prepared statements (e.g. PDO or mysqli bound parameters) so the decoded cookie value is never concatenated into SQL - this fully closes the injection regardless of encoding. As interim compensating controls for self-hosted operators: restrict network access to the login/GUI endpoint (bind to localhost or place behind a VPN/reverse proxy with IP allowlisting), which prevents remote exploitation but breaks legitimate remote access; deploy a WAF rule to inspect the decoded lastLogin cookie for SQL metacharacters and UNION/OR patterns, accepting that base64 encoding and WAF-evasion tricks can bypass naive signatures; and validate that safe_decode() output matches an expected format (e.g. numeric ID) before it reaches the query, rejecting anything containing quotes or SQL keywords. Monitor the repository at https://github.com/thebradleysanders/IOTSmartHome for an upstream fix.