# CVE-2026-50083: Aqara IAM/SSO Gateway hardcoded OAuth credentials

Source: https://junglewise.ai/threats/cve-2026-50083-aqara-iam-sso-gateway-hardcoded-oauth-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-50083 · Severity: critical · CVSS 9.1 · Published 2026-06-12

The Aqara IAM/SSO Gateway, a service used for managing user identities and access to smart home devices, contains hardcoded login credentials. An attacker can use these credentials to gain unauthorized access to the identity management system. When combined with other vulnerabilities, this could allow a remote attacker to take full control of Aqara smart locks, cameras, and hubs without needing a password.

Technologies: [Aqara IAM/SSO Gateway](https://junglewise.ai/threats/technologies/iam-sso-gateway). Vendors: [Aqara](https://junglewise.ai/threats/vendors/aqara).

## Quick answers

**Is CVE-2026-50083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50083 being exploited in the wild.

**How severe is CVE-2026-50083?** Critical severity, with a CVSS score of 9.1, published 12 June 2026.

**Which products and versions are affected?** Aqara IAM/SSO Gateway gw-builder.aqara.com.

**Is there a fix for CVE-2026-50083?** A patch was published on 2026-04-08: Vendor remediated various findings Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50083 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50083?** Check whether you run Aqara IAM/SSO Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) contains hardcoded OAuth client credentials (client_id 'test1' and client_secret '123456') that are accepted by the platform. An unauthenticated remote attacker can use these credentials via the /iam/oauthToken/openapi/client/token endpoint to obtain an access token with 'scope=all'. These tokens are long-lived and do not expire upon password changes. This vulnerability serves as a critical step in an exploit chain (including CVE-2026-50082, CVE-2026-50084, and CVE-2026-50085) that enables full remote takeover of IoT devices on the Aqara platform. The vendor reportedly remediated the issue in April 2026.

## Affected products

- Aqara IAM/SSO Gateway gw-builder.aqara.com

## Timeline

- 2026-03-13: disclosed: Researcher initiated outreach to vendor
- 2026-04-08: patched: Vendor remediated various findings
- 2026-04-20: other: Vendor acknowledged report and stated issue was fixed
- 2026-06-12: advisory: Public disclosure

## References

- [https://github.com/xn0tsa/theres-no-place-like-home](https://github.com/xn0tsa/theres-no-place-like-home)
- [https://www.runzero.com/advisories/aqara-hardcoded-oauth-cve-2026-50083](https://www.runzero.com/advisories/aqara-hardcoded-oauth-cve-2026-50083)

## Related threats

- [Aqara IAM/SSO Gateway open redirect in skipToUcAuthUrl](https://junglewise.ai/threats/cve-2026-50089-aqara-iam-sso-gateway-open-redirect-in-skiptoucauthurl)
- [Aqara IAM/SSO Gateway permissive CORS policy](https://junglewise.ai/threats/cve-2026-50087-aqara-iam-sso-gateway-permissive-cors-policy)
- [Aqara IAM/SSO Gateway unauthenticated AES oracle](https://junglewise.ai/threats/cve-2026-50086-aqara-iam-sso-gateway-unauthenticated-aes-oracle)