Is CVE-2026-50088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50088 being exploited in the wild.

How severe is CVE-2026-50088?

High severity, with a CVSS score of 8.2, published 12 June 2026.

Which products and versions are affected?

Aqara Developer Portal; Aqara Developer Test Portal.

Is there a fix for CVE-2026-50088?

A patch was published on 2026-04-08: Remediation of various findings by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50088 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-50088?

Check whether you run Aqara Developer Portal or Aqara Developer Test Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50088: Aqara Developer Portal Permissive CORS Policy

CVE-2026-50088 · Severity: high · CVSS 8.2 · Published 2026-06-12

The Aqara Developer Portal and its associated test environments were found to have a security misconfiguration in how they handle requests from other websites. This flaw could allow a malicious website to interact with the portal on behalf of a logged-in user if they visit the attacker's site. In practice, this could be used to register developer accounts in a victim's name or gather information about their account, potentially compromising the privacy and security of users on the Aqara IoT platform.

Vendors: Aqara.

Quick answers

Is CVE-2026-50088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50088 being exploited in the wild.
How severe is CVE-2026-50088?: High severity, with a CVSS score of 8.2, published 12 June 2026.
Which products and versions are affected?: Aqara Developer Portal; Aqara Developer Test Portal.
Is there a fix for CVE-2026-50088?: A patch was published on 2026-04-08: Remediation of various findings by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50088 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50088?: Check whether you run Aqara Developer Portal or Aqara Developer Test Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a permissive Cross-Origin Resource Sharing (CORS) misconfiguration (CWE-942). Specifically, the 'developer.aqara.com/open-server/*' endpoint reflects 'null' origins and 'https://*.github.io' origins into the 'Access-Control-Allow-Origin' header. Additionally, the test environments 'developer-test.aqara.com' and 'aiot-test.aqara.com' return 'Access-Control-Allow-Origin: *' for any origin. Because sandboxed iframes issue null-origin requests by default, exploitation is trivial from any web page. An attacker can leverage this to perform cross-origin actions or data exfiltration if a victim is authenticated to the portal. The vendor reportedly fixed the issue in April 2026.

Affected products

Aqara Developer Portal
Aqara Developer Test Portal

Timeline

2026-03-13: other: Vulnerability discovered and initial vendor outreach
2026-04-08: patched: Remediation of various findings by vendor
2026-04-20: other: Vendor acknowledged report and stated issue was fixed
2026-06-11: disclosed: Public disclosure by researcher
2026-06-12: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.