CVE-2026-50082: Aqara Developer Portal insecure authentication token
The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the portal's token-issuance flow so that developer tokens are issued only after proper authentication and verification (for example, validated account login and confirmed email) and ensure tokens are bound to the authenticated identity.
Aqara Developer Portal (developer.aqara.com) developer token issuance / authentication = require authenticated and verified identity before issuing developer tokens - Compensating control
Temporarily suspend or block issuance of new developer tokens (or restrict token issuance to known/trusted accounts) until the authentication/verification issue is fixed; enable enhanced logging and monitoring of token issuance and use to detect abuse.
- Operational
Revoke or invalidate any developer tokens that were issued without proper authentication, and rotate or replace any device or developer credentials that could have been impacted by those tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50082?
The severity of CVE-2026-50082 is rated as medium with a CVSS score of 6.5.
What is the impact of CVE-2026-50082?
CVE-2026-50082 allows attackers to obtain a developer token by using any email address, potentially compromising the security of the Aqara Cloud Developer Portal.
How do I fix CVE-2026-50082?
To fix CVE-2026-50082, implement proper authentication mechanisms to ensure that developer tokens are issued only to authorized email addresses.
What is the risk associated with CVE-2026-50082?
The risk associated with CVE-2026-50082 is classified as moderate, with a risk score of 40.
Which software is affected by CVE-2026-50082?
CVE-2026-50082 affects the Aqara Cloud Developer Portal.