CVE-2026-82452

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. The vulnerability is scored CVSS 3.1: 7.5 (HIGH) and CVSS 4.0: ...

CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

EUVD-2026-68108

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82452

rust-iot-platform (through commit 5df942ab) contains an authentication bypass caused by most REST API routes lacking authentication guards in their handler signatures, as seen in the user router. An unauthenticated attacker over the network with low complexity can create, update, list, retrieve, ...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

EUVD-2026-68107

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82452 rust-iot-platform Authentication Bypass via Missing Request Guards

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

CVE-2026-82453: Plaintext Storage of a Password

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82452: Missing Authentication for Critical Function

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected...

PT-2026-83431

Name of the Vulnerable Software and Affected Versions rust-iot-platform versions prior to commit 5df942ab Description An authentication bypass exists because most REST API routes lack authentication guards in their handler signatures. This allows unauthenticated attackers to perform administrativ...

PT-2026-83432

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-71278

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...

CVE-2026-71278

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...