CyberRota Analysis
AI-GeneratedThe vulnerability in rust-iot-platform's AuthToken request-guard allows unauthorized access to protected endpoints by merely including a non-empty Authorization HTTP header, as the implementation fails to validate the header's value against any session or token store. This critical flaw could lead to unauthorized actions and data exposure in applications relying on this authentication mechanism. Organizations using rust-iot-platform should prioritize immediate remediation to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.