CVE-2026-50087: Aqara IAM/SSO Gateway cross-origin resource sharing
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the gateway's CORS policy to only allow specific, pre-approved origin(s). Do not use a wildcard ('*') or reflect the incoming Origin header back to clients. Validate the Origin header against a whitelist and return a single explicit origin in Access-Control-Allow-Origin; ensure Access-Control-Allow-Credentials is only enabled when necessary and only for trusted origins.
Aqara IAM/SSO Gateway (gw-builder.aqara.com) CORS / Access-Control-Allow-Origin policy = restrict to specific trusted origins; do not use wildcard '*' or reflect the Origin header - Compensating control
Restrict network access to gw-builder.aqara.com to trusted IP ranges or internal networks (firewall/ACL/VPN) and/or place the gateway behind a WAF or reverse proxy that enforces origin checks to block cross-origin requests from untrusted domains.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50087?
The severity of CVE-2026-50087 is high, with a CVSS score of 8.2.
How do I fix CVE-2026-50087?
To mitigate CVE-2026-50087, ensure that the CORS policy is restrictive and only allows trusted domains.
What type of vulnerability is CVE-2026-50087?
CVE-2026-50087 is a cross-origin resource sharing vulnerability associated with permissive cross-domain policies.
What systems are affected by CVE-2026-50087?
CVE-2026-50087 affects the Aqara IAM/SSO Gateway hosted at gw-builder.aqara.com.
What could an attacker achieve with CVE-2026-50087?
An attacker could exploit CVE-2026-50087 to gain unauthorized access to sensitive resources by executing cross-origin requests.