CVE-2026-50083 Details
Description
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
A vulnerability exists in the Aqara IAM/SSO Gateway, specifically on the 'gw-builder.aqara.com' endpoint, due to the use of hardcoded OAuth client credentials. This vulnerability, categorized as 'CWE-798: Use of Hard-coded Credentials,' allows for the issuance of OAuth tokens with extensive privileges. The vulnerability is part of a larger chain that enables unauthenticated, remote takeover of affected devices, including smart locks, cameras, and hubs.
Aqara has acknowledged this vulnerability and issued a patch, but the hardcoded credentials in the mobile SDK and deployed firmware cannot be rotated without a coordinated update across the entire ecosystem.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xn0tsa/theres-no-place-like-home | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/xn0tsa/theres-no-place-like-home | runZero | ExploitThird Party Advisory |
| https://www.runzero.com/advisories/aqara-hardcoded-oauth-cve-2026-50083 | runZero | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | runZero |
Affected Products
| Product | Versions |
|---|---|
| aqara iam/sso gateway | 2026-04-20 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | runZero |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | runZero |