The rust-iot-platform's AuthToken request-guard (api/src/main.rs) improperly implements authentication by only verifying that the Authorization HTTP header exists without validating its content. This results in an authentication bypass (CWE-287), enabling unauthorized users to access protected endpoints by sending any non-empty Authorization header value. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

An attacker can gain unauthorized access to any endpoint protected solely by the flawed AuthToken request-guard by simply including any non-empty Authorization header in their HTTP request. This compromises confidentiality and integrity of the system without requiring authentication credentials or privileges. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, do not rely solely on the AuthToken request-guard for authentication. Implement additional validation of Authorization headers against a trusted session or token store to prevent unauthorized access.