The vulnerability lies in the authentication guard for the Rust IoT Platform; the guard only checks for the presence of an Authorization header and never validates its value against any session store, token store, or signature. Any request that includes a non‑empty Authorization header, such as `Authorization: fake`, satisfies the guard and grants full access to every endpoint protected only by it. This allows an attacker to bypass authentication and perform any operation on the platform. The weakness is classified as CWE‑287: Authentication Failure.

The affected product is the Rust IoT Platform developed by iot‑ecology. No specific version information is provided in the advisory, so all versions of the platform are potentially vulnerable until a patch is applied.

With a CVSS score of 9.1, the vulnerability is considered Critical. The EPSS score is 0.00241, indicating a very low but non-zero exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote HTTP requests; an attacker can craft any request with an arbitrary Authorization header to bypass authentication without needing valid credentials or network privileges. The exploit requires only the ability to send HTTP traffic to the vulnerable service, making it highly exploitable for remote attackers.