CVE-2026-50084: Aqara API cross-account access
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement proper authorization checks so that developer tokens are validated against the specific target account and only grant access to resources within that account (fix CWE-862 Missing Authorization).
Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) authorization = enforce account-scoped validation of developer tokens - Compensating control
Until proper per-account authorization is deployed, mitigate risk by restricting access to the production API (open-cn.aqara.com/v3.0/open/api) — for example, limit access to trusted IP ranges, disable developer-token-based access, or otherwise isolate the API endpoints from untrusted networks.
- Operational
Revoke or invalidate existing developer tokens issued prior to the fix and require re-issuance/rotation of developer tokens once per-account authorization is implemented.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50084?
The severity of CVE-2026-50084 is critical, with a CVSS score of 9.6.
How does CVE-2026-50084 affect the Aqara API?
CVE-2026-50084 allows unauthorized access to any account using a valid developer token due to missing authorization.
What are the potential impacts of CVE-2026-50084?
The impact of CVE-2026-50084 includes complete compromise of account data, potentially leading to data breaches.
How can I fix CVE-2026-50084?
To mitigate CVE-2026-50084, implement strict authorization checks for API access and validate tokens correctly.
Who is affected by CVE-2026-50084?
Any user or developer utilizing the Aqara Cloud Production API is potentially affected by CVE-2026-50084.