The vulnerability resides in IOTSmartHome's login interface, where a base64‑decoded cookie value is concatenated directly into an SQL query without sanitization, enabling SQL injection. An attacker can set a specially crafted lastLogin cookie, base64‑encode an injection payload, and trigger a UNION-based clause that bypasses authentication and retrieves user data, including credentials. This results in full unauthenticated access to sensitive information. The weakness corresponds to CWE‑89. The impact is both unauthorized access and data exposure.

Affected vendor and product: thebradleysanders IOTSmartHome. Specific version information was not disclosed in the advisory, so all released releases remain potentially exposed until a patch is applied.

The CVSS score of 9.8 marks this flaw as critical, and the EPSS score of 0.339% indicates a very low probability of exploitation. It is not yet listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated client manipulating the lastLogin cookie sent via a browser to the application. Once injected, the attacker can bypass authentication and extract arbitrary data. The severity is high, but due to the very low EPSS score, the actual exploitation risk is considered low.