# CVE-2026-50087: Aqara IAM/SSO Gateway permissive CORS policy

Source: https://junglewise.ai/threats/cve-2026-50087-aqara-iam-sso-gateway-permissive-cors-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-50087 · Severity: high · CVSS 8.2 · Published 2026-06-12

The Aqara IAM/SSO gateway, which manages user authentication and single sign-on for Aqara smart home devices, contains a security flaw in its web configuration. This vulnerability allows a malicious website to trick a user's browser into sharing sensitive authentication data, such as login responses and security codes, with the attacker. If exploited, this could lead to unauthorized access to a user's smart home account, potentially compromising connected devices like locks and cameras.

Technologies: [Aqara IAM/SSO Gateway](https://junglewise.ai/threats/technologies/iam-sso-gateway). Vendors: [Aqara](https://junglewise.ai/threats/vendors/aqara).

## Quick answers

**Is CVE-2026-50087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50087 being exploited in the wild.

**How severe is CVE-2026-50087?** High severity, with a CVSS score of 8.2, published 12 June 2026.

**Which products and versions are affected?** Aqara IAM/SSO Gateway All versions prior to 2026-04-08.

**Is there a fix for CVE-2026-50087?** A patch was published on 2026-04-08: Vulnerabilities remediated by the vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50087 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50087?** Check whether you run Aqara IAM/SSO Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Aqara IAM/SSO gateway (gw-builder.aqara.com) suffers from a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). Multiple endpoints under the /iam/* path, including login and password reset functions, reflect the requester's 'Origin' header into the 'Access-Control-Allow-Origin' response header and set 'Access-Control-Allow-Credentials' to true without validating against an allowlist. An attacker can exploit this by hosting a malicious webpage that, when visited by an authenticated Aqara user, performs cross-origin requests to read sensitive SSO responses, account oracles, and OAuth tokens. The vulnerability was confirmed on endpoints such as /iam/ucauth/openapi/login and /iam/oauthToken/aseEncrypt. The vendor reportedly remediated the issue in April 2026.

## Affected products

- Aqara IAM/SSO Gateway All versions prior to 2026-04-08

## Timeline

- 2026-03-13: other: Vulnerability discovered and initial vendor outreach
- 2026-04-08: patched: Vulnerabilities remediated by the vendor
- 2026-04-20: other: Vendor acknowledged report and confirmed fix
- 2026-06-12: disclosed: Public disclosure and CVE assignment

## References

- [https://github.com/xn0tsa/theres-no-place-like-home](https://github.com/xn0tsa/theres-no-place-like-home)
- [https://www.runzero.com/advisories/aqara-iam-sso-cors-cve-2026-50087](https://www.runzero.com/advisories/aqara-iam-sso-cors-cve-2026-50087)

## Related threats

- [Aqara IAM/SSO Gateway open redirect in skipToUcAuthUrl](https://junglewise.ai/threats/cve-2026-50089-aqara-iam-sso-gateway-open-redirect-in-skiptoucauthurl)
- [Aqara IAM/SSO Gateway unauthenticated AES oracle](https://junglewise.ai/threats/cve-2026-50086-aqara-iam-sso-gateway-unauthenticated-aes-oracle)
- [Aqara IAM/SSO Gateway hardcoded OAuth credentials](https://junglewise.ai/threats/cve-2026-50083-aqara-iam-sso-gateway-hardcoded-oauth-credentials)