CVE-2026-50083
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.
Risk Assessment
The organization is at risk of a full, unauthenticated remote takeover of Aqara devices, potentially compromising data confidentiality, integrity, and control over IoT infrastructure.
Recommendation
Immediately update the Aqara IAM/SSO Gateway firmware to a version that removes hardcoded OAuth credentials. In the meantime, restrict access to gw-builder.aqara.com to trusted networks only.
Other vulnerabilities in Aqara IAM/SSO Gateway
See all- CVE-2026-50086Critical
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes unauthenticated bidirectional AES access to the platform's signing key. This is a missing authentication for a critical function and use of a risky cryptographic algorithm.
- CVE-2026-50089Medium
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect vulnerability (CWE-601), allowing an attacker to redirect users to an external malicious site. The estimated CVSS score is 6.1 (Medium).
- CVE-2026-50087High
The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a cross-origin request sharing vulnerability due to a permissive cross-domain policy with untrusted domains (CWE-942), with an estimated CVSS score of 8.2 (High).
Original NVD description (English source)
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS