# CVE-2026-50088: Aqara Developer Portal Permissive CORS Policy

Source: https://junglewise.ai/threats/cve-2026-50088-aqara-developer-portal-permissive-cors-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-50088 · Severity: high · CVSS 8.2 · Published 2026-06-12

The Aqara Developer Portal and its associated test environments were found to have a security misconfiguration in how they handle requests from other websites. This flaw could allow a malicious website to interact with the portal on behalf of a logged-in user if they visit the attacker's site. In practice, this could be used to register developer accounts in a victim's name or gather information about their account, potentially compromising the privacy and security of users on the Aqara IoT platform.

Vendors: [Aqara](https://junglewise.ai/threats/vendors/aqara).

## Quick answers

**Is CVE-2026-50088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50088 being exploited in the wild.

**How severe is CVE-2026-50088?** High severity, with a CVSS score of 8.2, published 12 June 2026.

**Which products and versions are affected?** Aqara Developer Portal; Aqara Developer Test Portal.

**Is there a fix for CVE-2026-50088?** A patch was published on 2026-04-08: Remediation of various findings by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50088 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50088?** Check whether you run Aqara Developer Portal or Aqara Developer Test Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a permissive Cross-Origin Resource Sharing (CORS) misconfiguration (CWE-942). Specifically, the 'developer.aqara.com/open-server/*' endpoint reflects 'null' origins and 'https://*.github.io' origins into the 'Access-Control-Allow-Origin' header. Additionally, the test environments 'developer-test.aqara.com' and 'aiot-test.aqara.com' return 'Access-Control-Allow-Origin: *' for any origin. Because sandboxed iframes issue null-origin requests by default, exploitation is trivial from any web page. An attacker can leverage this to perform cross-origin actions or data exfiltration if a victim is authenticated to the portal. The vendor reportedly fixed the issue in April 2026.

## Affected products

- Aqara Developer Portal
- Aqara Developer Test Portal

## Timeline

- 2026-03-13: other: Vulnerability discovered and initial vendor outreach
- 2026-04-08: patched: Remediation of various findings by vendor
- 2026-04-20: other: Vendor acknowledged report and stated issue was fixed
- 2026-06-11: disclosed: Public disclosure by researcher
- 2026-06-12: advisory: NVD publication date

## References

- [https://github.com/xn0tsa/theres-no-place-like-home](https://github.com/xn0tsa/theres-no-place-like-home)
- [https://www.runzero.com/advisories/aqara-dev-portal-cors-cve-2026-50088](https://www.runzero.com/advisories/aqara-dev-portal-cors-cve-2026-50088)