Executive brief
The Aqara IAM/SSO gateway, which manages user authentication and single sign-on for Aqara smart home devices, contains a security flaw in its web configuration. This vulnerability allows a malicious website to trick a user's browser into sharing sensitive authentication data, such as login responses and security codes, with the attacker. If exploited, this could lead to unauthorized access to a user's smart home account, potentially compromising connected devices like locks and cameras.
Technical details
The Aqara IAM/SSO gateway (gw-builder.aqara.com) suffers from a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). Multiple endpoints under the /iam/* path, including login and password reset functions, reflect the requester's 'Origin' header into the 'Access-Control-Allow-Origin' response header and set 'Access-Control-Allow-Credentials' to true without validating against an allowlist. An attacker can exploit this by hosting a malicious webpage that, when visited by an authenticated Aqara user, performs cross-origin requests to read sensitive SSO responses, account oracles, and OAuth tokens. The vulnerability was confirmed on endpoints such as /iam/ucauth/openapi/login and /iam/oauthToken/aseEncrypt. The vendor reportedly remediated the issue in April 2026.
Affected products
- Aqara IAM/SSO Gateway All versions prior to 2026-04-08
Timeline
- 2026-03-13: other: Vulnerability discovered and initial vendor outreach
- 2026-04-08: patched: Vulnerabilities remediated by the vendor
- 2026-04-20: other: Vendor acknowledged report and confirmed fix
- 2026-06-12: disclosed: Public disclosure and CVE assignment