Executive brief
The Aqara Cloud Developer Portal, which provides tools for developers to integrate with Aqara smart home devices, failed to properly verify identities during account creation. An attacker could obtain a valid developer token simply by providing an email address, bypassing standard approval workflows. When combined with other vulnerabilities, this could allow an unauthorized person to take full control of smart home devices like locks, cameras, and hubs.
Technical details
The vulnerability is a missing authentication for a critical function (CWE-306) within the Aqara Cloud Developer Portal (developer.aqara.com). Specifically, the endpoint 'POST /open-server/authcode/get' accepted any email address and allowed the requester to complete a developer account signup without an approval workflow. This resulted in the issuance of valid Appid and Keyid credentials. These credentials could then be used to authorize calls to user-scope endpoints on the production API (open-cn.aqara.com). This flaw serves as the initial entry point for a multi-step exploit chain (including CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085) that enables unauthenticated remote takeover of affected IoT devices.
Affected products
- Aqara Cloud Developer Portal
Timeline
- 2026-03-13: disclosed: Researcher initiated outreach to vendor.
- 2026-04-20: patched: Vendor stated the issue has been fixed.
- 2026-06-12: advisory: Public disclosure of the vulnerability.