CVE-2026-50084

The vulnerability results from missing proper authorization verification (CWE-862 — Missing Authorization) in the Aqara cloud API production endpoint. The API accepts any valid developer token and grants access to resources regardless of which account the token actually belongs to. An attacker possessing their own legally obtained developer token can thereby access data and devices assigned to other users. Combined with vulnerabilities CVE-2026-50082, CVE-2026-50083, and CVE-2026-50085, the exploitation chain leads to fully unauthenticated remote device takeover.

An attacker can gain unauthorized access to any user's account on the Aqara platform, read data, and modify the configuration and state of smart home devices. Exploitation of this vulnerability together with related CVEs may result in complete remote takeover of devices without any prior authorization.

Apply patches available from the manufacturer according to references. It is also recommended to monitor developer token activity for access to unauthorized resources and restrict API token permissions to minimally required scopes.

Aqara Cloud Production API available at open-cn.aqara.com/v3.0/open/api; detailed information about affected versions is provided in the manufacturer's references