CVE-2026-50087: Aqara IAM/SSO Gateway cross-origin resource sharing

Synopsis

A permissive cross-origin resource sharing (CORS) misconfiguration affects the Aqara IAM/SSO Gateway (gw-builder.aqara.com). The vulnerability is reachable over the network and requires no authentication, but does require a victim to visit an attacker-controlled page in a browser. Successful exploitation allows an attacker to read sensitive data from the gateway and make limited modifications, effectively enabling cross-origin session or credential theft. No fix version has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The gateway is exposed over the network; an attacker must be able to direct HTTP requests at the service from a remote origin.

• AuthenticationNot required

  No credentials or account are needed to initiate the cross-origin request.

• Victim interactionRequired

  A victim must visit or be lured to an attacker-controlled web page that issues the malicious cross-origin request from their browser session.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special environmental conditions, race timing, or memory layout knowledge.

Blast Radius

• An attacker reads high-confidentiality data from the IAM/SSO gateway, including session tokens, identity assertions, or other authentication artifacts tied to the victim's active session.
• An attacker makes limited modifications to gateway-held data (integrity impact is low), such as altering profile fields or injecting short-lived state values.
• Because the scope is changed (S:C), the impact extends beyond the gateway itself, meaning harvested tokens or modified state can be used to pivot into other services that trust the SSO gateway.