PT-2026-48914 · Aqara · Aqara Cloud

Sammy Azdoufal + 1 · CVE-2026-50090 · Published 2026-06-12 · Updated 2026-06-13

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Aqara Cloud (affected versions not specified)

Description The OAuth Authorization Endpoint "open-cn.aqara.com/oauth/authorize" is subject to a redirect bypass caused by improper validation of unsafe equivalence in input. This flaw allows for domain matching bypass, which can be leveraged to facilitate phishing attacks and session theft.

Recommendations Disable OAuth integration until a fix is available.

Exploit

Fix

Weakness Enumeration

CWE-1289

Related Identifiers

CVE-2026-50090

Affected Products

Aqara Cloud

References · 5

• 🔥 https://github.com/xn0tsa/theres-no-place-like-home · Exploit
• 🔥 https://runzero.com/advisories/aqara-oauth-redirect-validation-bypass-cve-2026-50090 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-50090 · Security Note
• https://twitter.com/HugoValters/status/2065822844961874322 · Twitter Post
• https://t.me/CVEtracker/56711 · Telegram Post