A critical authentication bypass vulnerability in the Aikaan IoT management platform allows unauthenticated users to register accounts, potentially leading to unauthorized system access.

The platform relies on UI-level obfuscation to disable user sign-ups. Because the underlying API does not enforce this restriction, an unauthenticated attacker can bypass the intended configuration to create unauthorized accounts.

Assessed at a CVSS score of 9.8, this flaw allows for unauthorized account creation, which can be leveraged to gain administrative or user-level access to the IoT management platform. This compromises the entire device ecosystem managed by the platform, risking data exfiltration and unauthorized device control.

Immediate Action: Update the Aikaan IoT management platform to the latest available version provided by the vendor. Ensure that the API-level sign-up restriction is active and verified.

Proactive Monitoring: Audit existing user accounts for unauthorized or suspicious entries that may have been created via the registration API.

Compensating Controls: Implement network-level restrictions to limit access to the registration API endpoint to trusted IP ranges only.

Public Exploit Available: Unknown

The reliance on UI-level controls for security-critical functions is a significant design flaw. Organizations using the Aikaan IoT management platform should treat this as a high-priority issue and ensure that the patch is applied as soon as the vendor makes it available to close the unauthorized registration vector.