CVE-2026-50091: Aqara Home Android SDK hardcoded keys
Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove any hard-coded cryptographic keys from liblumidevsdk.so and from the Aqara Home Android app. Replace embedded static keys with secure key management (do not embed static keys in binaries). Rebuild the SDK and all white-label clients to use per-install or runtime-provisioned keys and platform-provided secure storage before redeploying.
Aqara Home Android SDK (liblumidevsdk.so) / Aqara Home Android (com.lumiunited.aqarahome) hardcoded_cryptographic_keys = removed / replaced with secure runtime key management - Compensating control
Until vulnerable SDK/app versions are replaced, limit exposure by applying network-level mitigations (for example, restrict access to services that accept these keys, isolate affected devices, or block traffic from vulnerable app instances) and remove vulnerable app builds from distribution where feasible.
- Operational
Treat any cryptographic keys found in released binaries as compromised: revoke or rotate those keys and issue new credentials/keys. Publish updated SDK and app releases and require integrators/white-label clients to update to the rebuilt versions that remove the hard-coded keys.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50091?
The severity of CVE-2026-50091 is rated as critical with a CVSS score of 9.1.
How do I fix CVE-2026-50091?
To fix CVE-2026-50091, implement secure key management practices and update to a version of the Aqara Home Android SDK that does not utilize hard-coded cryptographic keys.
What type of exposure does CVE-2026-50091 pose?
CVE-2026-50091 poses a risk of unauthorized data access due to hard-coded cryptographic keys in the Aqara Home Android SDK.
Which versions are affected by CVE-2026-50091?
CVE-2026-50091 affects Aqara Home Android version 6.0.0 and any white-label clients embedding the affected liblumidevsdk.so.
What is the main vulnerability mechanism of CVE-2026-50091?
The main vulnerability mechanism of CVE-2026-50091 is the use of hard-coded cryptographic keys, as highlighted by CWE-321.