Aikaan IoT Management Platform Authentication Bypass Vulnerability via Sign-Up API

An authentication bypass vulnerability has been identified in the Aikaan IoT management platform, specifically in version 3.25.0325-5-g2e9c59796. The platform allows unauthenticated users to register accounts through a sign-up API endpoint, even when the sign-up feature is disabled via the web interface. This oversight creates a loophole that could be exploited to gain unauthorized access to admin portals, undermining the platform's access control measures.

Impact

Exploitation of this vulnerability allows for unauthorized account creation, bypassing intended access controls. This could lead to unauthorized access to administrative functionalities or portals.