CVE-2026-50083

CriticalCVSS 9.1

Published: 12/06/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.

Risk Assessment

The organization is at risk of a full, unauthenticated remote takeover of Aqara devices, potentially compromising data confidentiality, integrity, and control over IoT infrastructure.

Recommendation

Immediately update the Aqara IAM/SSO Gateway firmware to a version that removes hardcoded OAuth credentials. In the meantime, restrict access to gw-builder.aqara.com to trusted networks only.

Original NVD description (English source)

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.