Read the docs

Aqara

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Aqara records in CISA KEV

No Aqara vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Camera Hub G3 Firmware 8 records HIGH Hub M2 Firmware 7 records HIGH Hub M3 Firmware 7 records HIGH Iam/sso Gateway 4 records HIGH Board Service 1 record HIGH Cloud Developer Portal 1 record HIGH Cloud Oauth Authorization Endpoint 1 record HIGH Cloud Production Api 1 record HIGH

Records

4 records in Iam/sso Gateway · all components

TI-2026-36879 CVE-2026-50086 · GHSA-3897-2crh-vgmr

Aqara unauthenticated AES oracle

Priority HIGH 82

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0029 Published 2026-06-12 Fixed in 0 CWE-327
TI-2026-36876 CVE-2026-50083 · GHSA-h5g5-hrhr-3ph4

Aqara hardcoded OAuth client credentials

Priority HIGH 82

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00364 Published 2026-06-12 Fixed in 0 CWE-798
TI-2026-36882 CVE-2026-50089 · GHSA-x2pr-g8vf-qfcp

Aqara IAM/SSO Gateway open redirect

Priority MEDIUM 60

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00196 Published 2026-06-12 Fixed in 0 CWE-601
TI-2026-36880 CVE-2026-50087 · GHSA-x4g8-9rgj-rr4r

Aqara IAM/SSO Gateway cross-origin resource sharing

Priority LOW 35

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS…

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00204 Published 2026-06-12 Fixed in 0 CWE-942
Open these records in search →