Is CVE-2026-50087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50087 being exploited in the wild.

How severe is CVE-2026-50087?

High severity, with a CVSS score of 8.2, published 12 June 2026.

Which products and versions are affected?

Aqara IAM/SSO Gateway All versions prior to 2026-04-08.

Is there a fix for CVE-2026-50087?

A patch was published on 2026-04-08: Vulnerabilities remediated by the vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50087 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-50087?

Check whether you run Aqara IAM/SSO Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50087: Aqara IAM/SSO Gateway permissive CORS policy

CVE-2026-50087 · Severity: high · CVSS 8.2 · Published 2026-06-12

The Aqara IAM/SSO gateway, which manages user authentication and single sign-on for Aqara smart home devices, contains a security flaw in its web configuration. This vulnerability allows a malicious website to trick a user's browser into sharing sensitive authentication data, such as login responses and security codes, with the attacker. If exploited, this could lead to unauthorized access to a user's smart home account, potentially compromising connected devices like locks and cameras.

Technologies: Aqara IAM/SSO Gateway. Vendors: Aqara.

Quick answers

Is CVE-2026-50087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50087 being exploited in the wild.
How severe is CVE-2026-50087?: High severity, with a CVSS score of 8.2, published 12 June 2026.
Which products and versions are affected?: Aqara IAM/SSO Gateway All versions prior to 2026-04-08.
Is there a fix for CVE-2026-50087?: A patch was published on 2026-04-08: Vulnerabilities remediated by the vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50087 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50087?: Check whether you run Aqara IAM/SSO Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Aqara IAM/SSO gateway (gw-builder.aqara.com) suffers from a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). Multiple endpoints under the /iam/* path, including login and password reset functions, reflect the requester's 'Origin' header into the 'Access-Control-Allow-Origin' response header and set 'Access-Control-Allow-Credentials' to true without validating against an allowlist. An attacker can exploit this by hosting a malicious webpage that, when visited by an authenticated Aqara user, performs cross-origin requests to read sensitive SSO responses, account oracles, and OAuth tokens. The vulnerability was confirmed on endpoints such as /iam/ucauth/openapi/login and /iam/oauthToken/aseEncrypt. The vendor reportedly remediated the issue in April 2026.

Affected products

Aqara IAM/SSO Gateway All versions prior to 2026-04-08

Timeline

2026-03-13: other: Vulnerability discovered and initial vendor outreach
2026-04-08: patched: Vulnerabilities remediated by the vendor
2026-04-20: other: Vendor acknowledged report and confirmed fix
2026-06-12: disclosed: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.