Executive brief
The Aqara Developer Portal and its associated test environments were found to have a security misconfiguration in how they handle requests from other websites. This flaw could allow a malicious website to interact with the portal on behalf of a logged-in user if they visit the attacker's site. In practice, this could be used to register developer accounts in a victim's name or gather information about their account, potentially compromising the privacy and security of users on the Aqara IoT platform.
Technical details
The vulnerability is a permissive Cross-Origin Resource Sharing (CORS) misconfiguration (CWE-942). Specifically, the 'developer.aqara.com/open-server/*' endpoint reflects 'null' origins and 'https://*.github.io' origins into the 'Access-Control-Allow-Origin' header. Additionally, the test environments 'developer-test.aqara.com' and 'aiot-test.aqara.com' return 'Access-Control-Allow-Origin: *' for any origin. Because sandboxed iframes issue null-origin requests by default, exploitation is trivial from any web page. An attacker can leverage this to perform cross-origin actions or data exfiltration if a victim is authenticated to the portal. The vendor reportedly fixed the issue in April 2026.
Affected products
- Aqara Developer Portal
- Aqara Developer Test Portal
Timeline
- 2026-03-13: other: Vulnerability discovered and initial vendor outreach
- 2026-04-08: patched: Remediation of various findings by vendor
- 2026-04-20: other: Vendor acknowledged report and stated issue was fixed
- 2026-06-11: disclosed: Public disclosure by researcher
- 2026-06-12: advisory: NVD publication date