CVE-2026-50086: Aqara IAM/SSO Gateway unauthenticated AES oracle

CVE-2026-50086 · Severity: critical · CVSS 10 · Published 2026-06-12

The Aqara IAM/SSO gateway, a central component for managing user identities and access to Aqara smart home devices, contains a security flaw that allows anyone on the internet to encrypt or decrypt data using the platform's master security key. An attacker can use this to bypass security controls, decrypt sensitive user tokens, or forge administrative credentials. This could lead to unauthorized access to smart locks, cameras, and other connected home devices across the entire Aqara platform.

Technologies: Aqara IAM/SSO Gateway. Vendors: Aqara.

Quick answers

Is CVE-2026-50086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50086 being exploited in the wild.
How severe is CVE-2026-50086?
Critical severity, with a CVSS score of 10, published 12 June 2026.
Which products and versions are affected?
Aqara IAM/SSO Gateway Cloud service (gw-builder.aqara.com).
Is there a fix for CVE-2026-50086?
A patch was published on 2026-04-20: Vendor stated the issue has been fixed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50086 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50086?
Check whether you run Aqara IAM/SSO Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes two endpoints, /iam/oauthToken/aseEncrypt and /iam/oauthToken/aseDecrypt, which perform bidirectional AES operations using the platform's internal signing key without requiring authentication. The implementation uses AES in ECB mode, as evidenced by identical ciphertext blocks for identical plaintext blocks. This vulnerability functions as a cryptographic oracle, allowing remote, unauthenticated attackers to decrypt captured session tokens or cookies and forge valid encrypted payloads. When combined with other vulnerabilities in the platform, this can be used to escalate privileges or gain unauthorized access to IoT devices. The vendor reportedly remediated the issue in April 2026.

Affected products

  • Aqara IAM/SSO Gateway Cloud service (gw-builder.aqara.com)

Timeline

  • 2026-03-13: disclosed: Initial discovery and vendor outreach by researcher Sammy Azdoufal.
  • 2026-04-20: patched: Vendor stated the issue has been fixed.
  • 2026-06-12: advisory: Public disclosure of the vulnerability.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.