CVE-2026-71277

Name of the Vulnerable Software and Affected Versions rust-iot-platform (affected versions not specified)

Description The AuthToken request-guard implementation in api/src/main.rs fails to validate the value of the Authorization HTTP header against a session, token store, or signature. It only verifies that the header is present. Consequently, any request containing a non-empty Authorization header can bypass the guard and gain access to all protected endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.