CVE-2026-50090

The OAuth endpoint improperly validates the redirect_uri parameter, applying overly permissive domain matching rules (CWE-1289: Improper Validation of Unsafe Equivalence in Input). An attacker can craft a malicious authorization link with a redirect_uri parameter pointing to a domain under their control, bypassing the applied checks. When a victim clicks such a link (requiring user interaction – UI:R), the OAuth server redirects the user along with the authorization code to the attacker's server. This results in session hijacking or access token compromise for the victim's Aqara account.

An attacker can intercept an OAuth authorization code and gain unauthorized access to an Aqara user's account, including personal data and smart home device control capabilities. The vulnerability is cross-site in nature (S:C – scope change), meaning the impact extends beyond the original authentication system.

Apply patches available from the vendor according to references. Administrators of integrations based on Aqara OAuth should monitor references at https://www.runzero.com/advisories/aqara-oauth-redirect-validation-bypass-cve-2026-50090 and restrict the use of OAuth integrations until Aqara confirms patch deployment.

Aqara Cloud OAuth endpoint available at open-cn.aqara.com/oauth/authorize; detailed information on affected versions provided in vendor references