CVE-2026-71277: rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. Authorization: fake) satisfies the guard, granting access to every endpoint protected only by this request guard.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71277?
CVE-2026-71277 has a severity rating of 9.1 out of 10, categorized as critical.
How do I fix CVE-2026-71277?
To fix CVE-2026-71277, ensure that the Authorization header value is validated against a session or token store.
What impact does CVE-2026-71277 have on my application?
CVE-2026-71277 allows attackers to bypass authentication by sending arbitrary values in the Authorization header.
Which software is affected by CVE-2026-71277?
CVE-2026-71277 affects the rust-iot-platform software.
When was CVE-2026-71277 published?
CVE-2026-71277 was published on August 5, 2026.