Harsh Raj Singhania

**Name of the Vulnerable Software and Affected Versions** rust-iot-platform versions prior to commit 5df942ab **Description** An authentication bypass exists because most REST API routes lack authentication guards in their handler signatures. This allows unauthenticated attackers to perform administrative actions, including creating, updating, listing, retrieving, and deleting user accounts, by directly accessing unprotected endpoints without valid credentials. **Recommendations** Update rust-iot-platform to a version beyond commit 5df942ab.

**Name of the Vulnerable Software and Affected Versions** rust-iot-platform versions prior to commit 5df942ab **Description** The software stores user passwords in cleartext within the user model instead of using hashing. This allows attackers to obtain plaintext credentials for all accounts by reading API responses from user retrieval and listing routes. **Recommendations** Update rust-iot-platform to a version beyond commit 5df942ab.