External risk intelligence

IOTSmartHome Login SQL Injection Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-71231

The vulnerability exists in the login authentication mechanism of a smart home management interface. Such interfaces are designed to be accessed over the network, and the login page is a public-facing entry point that must be reachable for users to manage their devices, making it a highly exposed surface by design.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical security flaw in a smart home management system's authentication process. An attacker can bypass login controls by manipulating a web cookie, potentially accessing sensitive user data. The main concern is confirming relevance and exposure to our smart home systems.

Unauthenticated access to smart home systems.
Protects sensitive customer and system data.
Verify system exposure and impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by manipulating a specially crafted cookie before sending it to the login page. The system will then improperly use this cookie to build a database query, allowing the attacker to bypass authentication and potentially steal sensitive information.

No authentication required to reach the component.
Manipulated cookie in login request.
Unauthorized access and data theft.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could bypass authentication and extract arbitrary data, including user credentials, from the user database. This is possible when the `checkCookie()` function in `gui/login.php` uses unsanitized data from a URL-safe base64-decoded `lastLogin` cookie to build an SQL query, allowing for SQL injection.

User credentials and arbitrary database data.
Via SQL injection in the login cookie.
Unauthorized access and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `gui/login.php` component of IOTSmartHome is vulnerable to SQL injection via a crafted `lastLogin` cookie. This allows unauthenticated attackers to bypass authentication and potentially extract sensitive data. The first step is to identify all instances of this software, determine their network accessibility and business criticality, and assign ownership for remediation.

Application owners should manage the fix.
Verify reachability and business criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IOTSmartHome software?

IOTSmartHome is a management platform used to control and monitor smart home devices. It typically provides a web-based interface that allows users to manage their home automation hardware through a centralized login portal.

What does CWE-89 mean for CVE-2026-71231?

CWE-89 refers to Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection. In this CVE, the software fails to clean data from a user-supplied cookie, allowing an attacker to insert malicious database commands that the system mistakenly executes.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending a specially crafted, base64-encoded string within the 'lastLogin' cookie to the application's login page. Simply visiting the page without a manipulated cookie does not trigger the flaw, as the vulnerability requires specific, malicious input to alter the underlying database query.

Is my system at risk?

According to Halo Surface Signal, this vulnerability is very likely to be relevant because smart home management interfaces are designed to be reachable over the network. If your IOTSmartHome login page is accessible from the internet, it acts as a public-facing entry point that an attacker can target without needing prior authentication.

How do I respond to this vulnerability?

First, locate all running instances of the IOTSmartHome software within your environment. Determine which systems are exposed to the network and prioritize those for review. Once identified, assign clear ownership to ensure the necessary patches or security updates are applied to the affected login component.

References

github.com/thebradleysanders/IOTSmartHome

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.