CVE-2026-71231 [CRITICAL] – IOTSmartHome’s gui/login.php checkCookie function builds an authentication query as SELECT

IOTSmartHome’s gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID=” after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.