Executive brief
Aqara's cloud login service, which allows users to connect their smart home devices to third-party apps, contains a flaw in how it handles web redirects. An attacker could trick a user into clicking a malicious link that appears to be a legitimate login page, but instead sends the user's secret access credentials to a server controlled by the attacker. This could lead to unauthorized access to the user's smart home account, potentially allowing the attacker to control smart locks, cameras, and other connected home security devices.
Technical details
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) fails to perform exact matching on the 'redirect_uri' parameter. Instead, the endpoint uses a suffix-based validation logic that allows any URI ending in 'aqara.com' to pass (e.g., 'https://aqara.com.attacker.com'). An attacker can craft a malicious OAuth authorization request and, upon a victim providing consent, the resulting authorization code is transmitted to the attacker-controlled domain. This is classified as CWE-1289 (Improper Validation of Unsafe Equivalence in Input). The vendor reportedly remediated the issue on April 20, 2026.
Affected products
- Aqara Cloud OAuth Authorization Endpoint All versions prior to April 20, 2026
Timeline
- 2026-03-13: disclosed: Researcher discovered issues and initiated vendor outreach.
- 2026-04-20: patched: Vendor stated the issue has been fixed.
- 2026-06-12: advisory: Public disclosure of the vulnerability.