---
id: CVE-2026-82452
title: >-
  rust-iot-platform through commit 5df942ab contains an authentication bypass
  vulnerability where most REST API routes lack authentication guards in their
  handler signatures
summary: >-
  rust-iot-platform through commit 5df942ab contains an authentication bypass
  vulnerability where most REST API routes lack authentication guards in their
  handler signatures. Unauthenticated attackers can create, update, list,
  retrieve, an…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-08-29'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82452'
references:
  - url: 'https://github.com/iot-ecology/rust-iot-platform'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/controller/user_router.rs
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00826
epssPercentile: 0.57233
ingestedAt: '2026-08-30T07:49:08.554Z'
vendor: iot-ecology
product: rust-iot-platform
affected:
  - rust-iot-platform <= 5df942ab6bc46a3bf83dbee8c7970554f92c972d
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-01T02:09:22.592103Z'
---

## Overview

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.