CVE-2026-71231

Name of the Vulnerable Software and Affected Versions IOTSmartHome (affected versions not specified)

Description The checkCookie() function in the 'gui/login.php' endpoint is susceptible to SQL injection. The issue occurs when the system processes the lastLogin cookie using the safe decode() function, which performs URL-safe base64 decoding without sanitizing the resulting value before incorporating it into a SQL query. An unauthenticated attacker can provide a base64-encoded payload within the lastLogin cookie to bypass authentication or use UNION-based injection to extract sensitive data, such as user credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the 'gui/login.php' endpoint or disable the use of the lastLogin cookie.