SQL Injection Vulnerability in IOTSmartHome by IOTSmartHome
CVE-2026-71231

9.8CRITICAL

Key Information:

Vendor

Thebradleysanders

Status
Iotsmarthome
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71231?

The authentication mechanism in IOTSmartHome's login process is vulnerable to SQL injection via the lastLogin cookie. The use of base64-decoding without proper sanitization allows an attacker to craft a malicious lastLogin cookie containing an SQL injection payload, such as base64 encodings that can bypass authentication controls. This vulnerability can lead to unauthorized access and potential exposure of sensitive user data, including credentials. It is imperative for users of IOTSmartHome to ensure their systems are updated to mitigate this risk.

Affected Version(s)

IOTSmartHome 0

References

https://github.com/thebradleysanders/IOTSmartHome

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mirdavlatov Mira'zam
.