---
id: CVE-2026-82452
title: >-
  rust-iot-platform through commit 5df942ab contains an authentication bypass
  vulnerability where most REST API routes lack authentication guards in their
  handler signatures
summary: >-
  rust-iot-platform through commit 5df942ab contains an authentication bypass
  vulnerability where most REST API routes lack authentication guards in their
  handler signatures. Unauthenticated attackers can create, update, list,
  retrieve, an…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
published: '2026-08-29'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82452'
references:
  - url: 'https://github.com/iot-ecology/rust-iot-platform'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/controller/user_router.rs
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00458
epssPercentile: 0.39019
ingestedAt: '2026-08-30T07:49:08.554Z'
---

## Overview

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.