The rust-iot-platform project, through commit 5df942ab, stores user passwords in plaintext without hashing in the user model. This critical security flaw allows attackers to retrieve plaintext credentials for all accounts by reading API responses from user retrieval and listing routes. The vulnerability exposes all user accounts to credential theft, as no password hashing mechanism is implemented. The affected code is located in the user_biz.rs file within the API source. This issue poses a significant risk to any deployment of the platform, as compromised credentials can lead to full account takeover and lateral movement.
