EUVD-2026-53362
GHSA-82xc-gf8p-89h7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote, no auth, and no interaction since any non-empty header defeats the guard (AV:N/AC:L/PR:N/UI:N); full read/write of protected data gives C:H/I:H, with no availability impact so A:N.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. Authorization: fake) satisfies the guard, granting access to every endpoint protected only by this request guard.
AnalysisAI
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the AuthToken request guard simply by sending a non-empty Authorization header such as 'Authorization: fake'. The Rocket request guard in api/src/main.rs checks only for the header's presence and never validates its value against a session, token store, or signature, so unauthenticated attackers gain full access to protected API functionality. No public exploit identified at time of analysis, but the flaw is trivial to trigger and carries a CVSS 9.1.
Technical ContextAI
The platform is written in Rust and built on the Rocket web framework, which uses typed 'request guards' to enforce authorization before a handler runs. Here the custom AuthToken guard implemented in api/src/main.rs performs a presence-only check on the HTTP Authorization header and returns success as long as the header exists and is non-empty, without comparing it to any issued token, JWT signature, session record, or credential store. This maps to CWE-287 (Improper Authentication): the authentication decision is made on the existence of input rather than its correctness, so the guard is effectively a no-op. The affected component is identified by CPE cpe:2.3:a:iot-ecology:rust-iot-platform, an IoT data/management platform, meaning device, sensor, and configuration APIs sitting behind this guard are exposed.
RemediationAI
No vendor-released patch identified at time of analysis, and the CPE lists all versions as affected, so remediation must currently be applied at the source level: modify the AuthToken request guard in api/src/main.rs so it validates the Authorization header value - verify a signed/opaque token against the session or token store, reject empty and unrecognized values, and return an Unauthorized outcome (Rocket forward/failure) on any mismatch rather than succeeding on presence alone. Track upstream at https://github.com/iot-ecology/rust-iot-platform for a corrected commit or release. As compensating controls until a validated fix is deployed, place the API behind an authenticating reverse proxy or API gateway that enforces real credentials (side effect: legitimate clients must be reconfigured with those credentials), and restrict network exposure of the API endpoints to trusted management networks or a VPN via firewall/allowlist rules (side effect: breaks any intended public/device access, so IoT devices calling the API must be inside the allowed range). Avoid relying on the built-in guard for any sensitive route until it performs true validation.
More in Rust Iot Platform
View allUnauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpo
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to h
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today