Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck
CVE-2026-82452rust-iot-platform Authentication Bypass via Missing Request Guards
Critical 9.8
In plain English
A critical-severity missing authentication in rust-iot-platform from iot-ecology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 42.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| iot-ecology | rust-iot-platform | 0 – through 5df942ab6bc46a3bf83dbee8c7970554f92c972d |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Vulnerable code: user_router.rs (handlers without AuthToken) technical-description
- https://github.com/iot-ecology/rust-iot-platform product
- VulnCheck Advisory: rust-iot-platform Authentication Bypass via Missing Request Guards third-party-advisory