Impact Analysis

This vulnerability can lead to unauthorized access to sensitive user information such as account details, authentication codes, and OAuth URLs by malicious websites.

An attacker exploiting this flaw could potentially hijack user sessions or perform actions on behalf of the user, compromising the confidentiality and integrity of user data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-50087 is a cross-origin resource sharing (CORS) vulnerability in the Aqara IAM/SSO Gateway, specifically affecting endpoints under the /iam/* path.

The vulnerability allows malicious websites to read sensitive single sign-on (SSO) responses from a victim's browser session, including account details, authentication codes, and OAuth URLs.

This happens because the gateway reflects the request's Origin header into the Access-Control-Allow-Origin response header without proper validation, and it sets Access-Control-Allow-Credentials to true, creating a permissive cross-domain policy that enables unauthorized data access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the HTTP responses from the Aqara IAM/SSO Gateway endpoints under the /iam/* path to check if the Access-Control-Allow-Origin header reflects the Origin header without proper validation and if Access-Control-Allow-Credentials is set to true.

You can use curl commands to test this behavior by sending requests with a custom Origin header and observing the response headers.

• curl -H "Origin: http://malicious.example.com" -I https://gw-builder.aqara.com/iam/some_endpoint
• Check if the response includes Access-Control-Allow-Origin: http://malicious.example.com and Access-Control-Allow-Credentials: true, which indicates the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the Aqara IAM/SSO Gateway to the vendor-provided fixed version released on April 8, 2026.

If updating immediately is not possible, restrict access to the vulnerable endpoints by network controls or firewall rules to limit exposure.

Additionally, monitor for suspicious cross-origin requests and consider disabling or limiting cross-origin resource sharing policies until the patch is applied.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows malicious websites to read sensitive single sign-on (SSO) responses from a victim's browser session, including account details, authentication codes, and OAuth URLs. This unauthorized data access could lead to exposure of personal and authentication information.

Such exposure of sensitive user data may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on personal and authentication information to prevent unauthorized access and data breaches.

However, the provided information does not explicitly state the direct compliance implications or specific regulatory impacts of this vulnerability.

Useful 0 Not Useful 0