Aqara vulnerabilities

Newest CVEs

• CVE-2026-50091

  Aqara Home Android SDK hardcoded keys

  Aqara · com.lumiunited.aqarahome

  Critical9.1
• CVE-2026-50090

  Aqara OAuth redirect_uri validation bypass

  Aqara · Cloud OAuth Authorization Endpoint

  Critical9.3
• CVE-2026-50089

  Aqara IAM/SSO Gateway open redirect

  Aqara · Aqara IAM/SSO Gateway

  Medium6.1
• CVE-2026-50088

  Aqara Developer Portal cross-origin resource sharing

  Aqara · Aqara Developer Portal

  High8.2
• CVE-2026-50087

  Aqara IAM/SSO Gateway cross-origin resource sharing

  Aqara · Aqara IAM/SSO Gateway

  High8.2
• CVE-2026-50086

  Aqara unauthenticated AES oracle

  Aqara · Aqara IAM/SSO Gateway

  Critical10.0
• CVE-2026-50085

  Aqara Board IoT insecure debug API

  Aqara · Board service

  High8.6
• CVE-2026-50084

  Aqara API cross-account access

  Aqara · Cloud Production API

  Critical9.6
• CVE-2026-50083

  Aqara hardcoded OAuth client credentials

  Aqara · Aquara IAM/SSO Gateway

  Critical9.1
• CVE-2026-50082

  Aqara Developer Portal insecure authentication token

  Aqara · Cloud Developer Portal

  Medium6.5