rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

CVE-2026-82452 affects rust-iot-platform through commit 5df942ab, where most REST API routes lack authentication guards in their handler signatures. This allows unauthenticated attackers to fully interact with user account endpoints without providing any credentials. Attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints. The vulnerability is rooted in missing request guards in the Rocket-based Rust web framework used by the platform. The specific vulnerable file identified is api/src/controller/user_router.rs. This is a critical authentication bypass issue affecting IoT platform deployments. No patch or fix version has been specified beyond the vulnerable commit reference.