The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NAqara Iam\/sso Gateway
APPAqara2026-04-20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2026-50083CRITICAL9.1PL ✓same product
Aqara IAM/SSO Gateway — zakodowane na stałe dane uwierzytelniające OAuth
CVE-2026-50086CRITICAL10.0PL ✓same product
Aqara IAM/SSO: nieuwierzytelniony oracle AES ujawniający klucz podpisujący
CVE-2026-50089MEDIUM6.1same product
Brama IAM/SSO Aqara (gw-builder.aqara.com) zawiera podatność open redirect, będącą instancją "CWE-601: URL Red...
CVE-2026-50084CRITICAL9.6PL ✓same vendor
Brak autoryzacji w Aqara Cloud Production API umożliwia przejęcie konta
CVE-2026-50090CRITICAL9.3PL ✓same vendor
Aqara Cloud OAuth – bypass walidacji redirect URI (open redirect)