Read the docs

Aqara

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Aqara records in CISA KEV

No Aqara vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Camera Hub G3 Firmware 8 records HIGH Hub M2 Firmware 7 records HIGH Hub M3 Firmware 7 records HIGH Iam/sso Gateway 4 records HIGH Board Service 1 record HIGH Cloud Developer Portal 1 record HIGH Cloud Oauth Authorization Endpoint 1 record HIGH Cloud Production Api 1 record HIGH

Records

1 record in Cloud Oauth Authorization Endpoint · all components

TI-2026-36883 CVE-2026-50090 · GHSA-r6gg-58h5-pw3w

Aqara OAuth redirect_uri validation bypass

Priority HIGH 75

The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe…

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00246 Published 2026-06-12 Fixed in 0 CWE-1289
Open these records in search →