CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

CVE-2026-71231

Summary of CVE-2026-71231 (IOTSmartHome) : The checkCookie() function in gui/login.php builds an authentication query by concatenating a decoded lastLogin cookie (base64-decoded with safe_decode()) into SQL: SELECT * FROM users WHERE ID=''. Lack of sanitization before SQL string construction enab...

CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...