CVE-2026-50083: Aqara hardcoded OAuth client credentials
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the hardcoded OAuth client credential with unique, securely generated client credentials per deployment. Do not embed secrets in code or firmware; store credentials in a secure secret store or protected configuration and implement automated credential rotation.
Aqara IAM/SSO Gateway (gw-builder.aqara.com) OAuth client credential = remove hardcoded credential; use unique per-deployment client credentials stored securely - Compensating control
If code/firmware updates cannot be applied immediately, restrict access to gw-builder.aqara.com and related management endpoints to trusted IP ranges and internal networks (firewall/ACL/WAF rules) to reduce remote exposure until the hardcoded credential is removed.
- Operational
Revoke the hardcoded OAuth client credential and any OAuth tokens issued using it. Generate and deploy new client credentials, rotate them across affected systems, and invalidate any sessions that relied on the compromised credential.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50083?
CVE-2026-50083 has a critical severity rating of 9.1.
What vulnerabilities are related to CVE-2026-50083?
CVE-2026-50083 is related to CVE-2026-50082 and CVE-2026-50084.
How do I fix CVE-2026-50083?
To mitigate CVE-2026-50083, update to a version of the Aqara IAM/SSO Gateway that does not use hardcoded OAuth client credentials.
What type of vulnerability is CVE-2026-50083 categorized as?
CVE-2026-50083 is categorized as an instance of CWE-798: Use of Hard-coded Credentials.
What is the impact of CVE-2026-50083?
CVE-2026-50083 could result in unauthorized access due to exposed OAuth client credentials.