CVE-2026-50090: Aqara OAuth redirect_uri validation bypass
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce strict (exact) comparison of the redirect_uri in incoming authorization requests against a whitelist of pre-registered redirect URIs. Compare scheme, host, port and path exactly; disallow wildcard, partial, or equivalence-based domain matches that enable redirect bypass.
Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) redirect_uri validation / domain matching = strict exact match (no wildcards or equivalence-based matching) - Configuration
Require all clients to pre-register exact redirect_uri values and reject authorization requests where the redirect_uri does not exactly match one of the registered values.
OAuth client registration accept_only_registered_redirect_uris = true - Compensating control
If immediate code changes are not possible, deploy WAF or reverse-proxy rules to block authorization requests where the redirect_uri parameter points to untrusted or unregistered domains or that use patterns indicative of domain-matching bypass (e.g., appended domains, encoded separators). Log and alert on blocked attempts.
- Operational
Audit all existing OAuth client registrations and authorization logs for uses of lax or ambiguous redirect URIs; update or remove registrations that rely on permissive domain matching and remediate any clients that may be affected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50090?
The severity of CVE-2026-50090 is rated as critical with a score of 9.3.
How do I fix CVE-2026-50090?
To mitigate CVE-2026-50090, ensure strict validation checks on redirect_uri parameters in the OAuth Authorization process.
What kind of vulnerability is CVE-2026-50090?
CVE-2026-50090 is an instance of improper validation of unsafe equivalence in input, specifically related to redirect URI validation.
What systems are affected by CVE-2026-50090?
CVE-2026-50090 affects the Aqara Cloud OAuth Authorization Endpoint located at open-cn.aqara.com/oauth/authorize.
What are the potential impacts of CVE-2026-50090?
The potential impacts of CVE-2026-50090 include unauthorized access and redirection to malicious sites due to lax domain matching.