The vulnerability lies in the authentication guard for the Rust IoT Platform; the guard only checks for the presence of an Authorization header, ignoring its value. Any request that includes a non‑empty Authorization header, such as `Authorization: fake`, satisfies the guard and grants full access to every endpoint that relies on it. This effectively bypasses authentication, allowing an attacker to read, modify, or delete data, execute commands, and potentially compromise the entire platform. The weakness is classified as CWE‑287: Authentication Failure.

The affected product is the Rust IoT Platform developed by iot‑ecology. No specific version information is provided in the advisory, so all versions of the platform are potentially vulnerable until a patch is applied.

With a CVSS score of 9.1, the vulnerability is considered Critical. The advisories do not report an EPSS score or KEV inclusion. Based on the description, the likely attack vector is remote HTTP requests; an attacker can craft any request with an arbitrary Authorization header to bypass authentication without needing valid credentials or network privileges. The exploit requires only the ability to send HTTP traffic to the vulnerable service, making it highly exploitable for remote attackers.