# CVE-2026-50090: Aqara Cloud OAuth redirect validation bypass

Source: https://junglewise.ai/threats/cve-2026-50090-aqara-cloud-oauth-redirect-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-50090 · Severity: critical · CVSS 9.3 · Published 2026-06-12

Aqara's cloud login service, which allows users to connect their smart home devices to third-party apps, contains a flaw in how it handles web redirects. An attacker could trick a user into clicking a malicious link that appears to be a legitimate login page, but instead sends the user's secret access credentials to a server controlled by the attacker. This could lead to unauthorized access to the user's smart home account, potentially allowing the attacker to control smart locks, cameras, and other connected home security devices.

Vendors: [Aqara](https://junglewise.ai/threats/vendors/aqara).

## Quick answers

**Is CVE-2026-50090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50090 being exploited in the wild.

**How severe is CVE-2026-50090?** Critical severity, with a CVSS score of 9.3, published 12 June 2026.

**Which products and versions are affected?** Aqara Cloud OAuth Authorization Endpoint All versions prior to April 20, 2026.

**Is there a fix for CVE-2026-50090?** A patch was published on 2026-04-20: Vendor stated the issue has been fixed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50090 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50090?** Check whether you run Aqara Cloud OAuth Authorization Endpoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) fails to perform exact matching on the 'redirect_uri' parameter. Instead, the endpoint uses a suffix-based validation logic that allows any URI ending in 'aqara.com' to pass (e.g., 'https://aqara.com.attacker.com'). An attacker can craft a malicious OAuth authorization request and, upon a victim providing consent, the resulting authorization code is transmitted to the attacker-controlled domain. This is classified as CWE-1289 (Improper Validation of Unsafe Equivalence in Input). The vendor reportedly remediated the issue on April 20, 2026.

## Affected products

- Aqara Cloud OAuth Authorization Endpoint All versions prior to April 20, 2026

## Timeline

- 2026-03-13: disclosed: Researcher discovered issues and initiated vendor outreach.
- 2026-04-20: patched: Vendor stated the issue has been fixed.
- 2026-06-12: advisory: Public disclosure of the vulnerability.

## References

- [https://github.com/xn0tsa/theres-no-place-like-home](https://github.com/xn0tsa/theres-no-place-like-home)
- [https://www.runzero.com/advisories/aqara-oauth-redirect-validation-bypass-cve-2026-50090](https://www.runzero.com/advisories/aqara-oauth-redirect-validation-bypass-cve-2026-50090)