Executive brief
The Aqara IAM/SSO gateway, a central component for managing user identities and access to Aqara smart home devices, contains a security flaw that allows anyone on the internet to encrypt or decrypt data using the platform's master security key. An attacker can use this to bypass security controls, decrypt sensitive user tokens, or forge administrative credentials. This could lead to unauthorized access to smart locks, cameras, and other connected home devices across the entire Aqara platform.
Technical details
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes two endpoints, /iam/oauthToken/aseEncrypt and /iam/oauthToken/aseDecrypt, which perform bidirectional AES operations using the platform's internal signing key without requiring authentication. The implementation uses AES in ECB mode, as evidenced by identical ciphertext blocks for identical plaintext blocks. This vulnerability functions as a cryptographic oracle, allowing remote, unauthenticated attackers to decrypt captured session tokens or cookies and forge valid encrypted payloads. When combined with other vulnerabilities in the platform, this can be used to escalate privileges or gain unauthorized access to IoT devices. The vendor reportedly remediated the issue in April 2026.
Affected products
- Aqara IAM/SSO Gateway Cloud service (gw-builder.aqara.com)
Timeline
- 2026-03-13: disclosed: Initial discovery and vendor outreach by researcher Sammy Azdoufal.
- 2026-04-20: patched: Vendor stated the issue has been fixed.
- 2026-06-12: advisory: Public disclosure of the vulnerability.