CVE-2026-50086: Aqara unauthenticated AES oracle
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable bidirectional/unauthenticated AES encryption/decryption endpoints against the platform signing key. Require strong authentication and authorization for any cryptographic operations that use or expose signing keys.
Aqara IAM/SSO gateway (gw-builder.aqara.com) unauthenticated AES round-trip support = disabled - Compensating control
Until the vulnerability is remediated, restrict access to gw-builder.aqara.com to trusted networks/IPs (for example via firewall rules, VPN or WAF), and enable detailed access logging and monitoring of the service.
- Operational
Rotate and replace the platform signing key used by the gateway and revoke any tokens, signatures, or credentials produced with the exposed key. Ensure dependent services are updated to use the new key.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50086?
CVE-2026-50086 has a severity rating of critical with a score of 10.
How do I fix CVE-2026-50086?
To mitigate CVE-2026-50086, secure the gateway by implementing proper authentication measures and ensuring the use of secure cryptographic algorithms.
What are the potential impacts of CVE-2026-50086?
CVE-2026-50086 can lead to unauthorized access and exploitation of the platform's signing key, compromising confidentiality, integrity, and availability.
Is CVE-2026-50086 exploitable remotely?
Yes, CVE-2026-50086 is exploitable remotely due to its lack of authentication requirements.
Which software is affected by CVE-2026-50086?
CVE-2026-50086 affects the Aqara IAM/SSO gateway available at gw-builder.aqara.com.