CVE-2026-50090: Aqara OAuth redirect_uri validation bypass

Synopsis

An OAuth redirect_uri validation bypass affects the Aqara Cloud OAuth Authorization Endpoint at open-cn.aqara.com/oauth/authorize. The endpoint is reachable over the network without authentication, but a victim must follow a crafted authorization link for the attack to succeed. Successful exploitation lets an attacker steal OAuth authorization codes and access tokens, and tamper with OAuth-linked account data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable OAuth endpoint is exposed over the internet; the attacker must be able to send the victim a crafted URL that reaches open-cn.aqara.com over the network.

• AuthenticationNot required

  No account or credential is needed to craft or deliver the malicious authorization request.

• Victim interactionRequired

  The victim must follow a crafted OAuth authorization link, making this a social-engineering vector where the attacker tricks the user into clicking the URL.

• Attack complexityDetail

  Attack complexity is low; the exploit requires no race condition, special memory layout, or environmental prerequisite beyond delivering the malicious link.

Blast Radius

• Attacker captures OAuth authorization codes redirected to an attacker-controlled URI, enabling full account takeover on any service the victim authorized.
• Attacker obtains valid access tokens and can read private device data, automation rules, and any personal information exposed through the Aqara Cloud API.
• Attacker can issue authenticated API requests on behalf of the victim, modifying device configurations, automation schedules, and account-linked settings.