Is CVE-2026-50091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50091 being exploited in the wild.

How severe is CVE-2026-50091?

Critical severity, with a CVSS score of 9.1, published 12 June 2026.

Is there a fix for CVE-2026-50091?

A patch was published on 2026-04-08: Vendor remediated various findings Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50091 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50091?

Check whether you run Aqara Home at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50091: Aqara Home Android hard-coded cryptographic keys in liblumidevsdk.so

CVE-2026-50091 · Severity: critical · CVSS 9.1 · Published 2026-06-12

The Aqara Home Android application and its associated developer tools contain permanent, unchangeable security keys used to protect smart home devices. An attacker who extracts these keys can potentially intercept private camera feeds, forge commands to smart locks, and impersonate legitimate devices. This impacts the privacy and physical security of users relying on the Aqara smart home ecosystem.

Vendors: Aqara.

Quick answers

Is CVE-2026-50091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50091 being exploited in the wild.
How severe is CVE-2026-50091?: Critical severity, with a CVSS score of 9.1, published 12 June 2026.
Which products and versions are affected?: Aqara Home 6.0.0.
Is there a fix for CVE-2026-50091?: A patch was published on 2026-04-08: Vendor remediated various findings Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50091 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50091?: Check whether you run Aqara Home at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the use of hard-coded cryptographic keys within the 'liblumidevsdk.so' native library in Aqara Home Android version 6.0.0. These static keys are used for camera authentication signatures, device pairing payloads, and general content encryption between the client and the Aqara platform. Because the keys are identical across all installations and white-label variants, they can be recovered via static analysis (strings) of the APK. An attacker can leverage these keys to decrypt intercepted traffic or forge authentication signatures to gain unauthorized access to IoT devices like cameras and hubs. Fixes were reportedly coordinated with the vendor, though some issues remained as of the disclosure date.

Affected products

Aqara Aqara Home Android 6.0.0

Timeline

2026-03-13: other: Vulnerability discovered and initial vendor outreach
2026-04-08: patched: Vendor remediated various findings
2026-06-12: disclosed: Public disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.