CVE-2026-50086
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes unauthenticated bidirectional AES access to the platform's signing key. This is a missing authentication for a critical function and use of a risky cryptographic algorithm.
Risk Assessment
An unauthenticated attacker can retrieve the signing key, enabling token forgery and impersonation of users or devices, leading to data confidentiality breaches.
Recommendation
Immediately implement authentication for all critical gateway functions and replace the risky AES algorithm with a more secure solution compliant with current standards.
Other vulnerabilities in Aqara IAM/SSO gateway
See all- CVE-2026-50083Critical
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) uses a hardcoded OAuth client credential, violating CWE-798 (Use of Hard-coded Credentials). This vulnerability has an estimated CVSS score of 9.1 (Critical) and allows unauthenticated remote attacks.
- CVE-2026-50089Medium
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect vulnerability (CWE-601), allowing an attacker to redirect users to an external malicious site. The estimated CVSS score is 6.1 (Medium).
- CVE-2026-50087High
The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a cross-origin request sharing vulnerability due to a permissive cross-domain policy with untrusted domains (CWE-942), with an estimated CVSS score of 8.2 (High).
Original NVD description (English source)
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS