TI-2026-56850 CVE-2026-82453 · GHSA-3wcf-94mw-cwgf
rust-iot-platform Cleartext Password Storage via User Model
Priority MEDIUM 44
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model.
Vulnerabilities
4 records
TI-2026-56849 CVE-2026-82452 · GHSA-hc3c-8h8r-vcg7
rust-iot-platform Authentication Bypass via Missing Request Guards
Priority MEDIUM 50
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures.
TI-2026-49945 CVE-2026-71278 · GHSA-j4r7-rp8f-vhp4
rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
Priority MEDIUM 50
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field.
TI-2026-49944 CVE-2026-71277 · GHSA-82xc-gf8p-89h7
rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
Priority MEDIUM 48
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature.