Aqara IAM/SSO Gateway Hardcoded OAuth Credentials Enable Unauth Takeover (CVE-2026-50083)

Vulnerability Overview The Aqara IAM/SSO Gateway (gw.builder.aqara.com) uses hardcoded OAuth client credentials, an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS score of 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, it can lead to full unauthorized remote takeover of affected devices. Impact Scope Vendor: Aqara Product: Aqara IAM/SSO Gateway Related CVEs: CVE-2026-50083 Remediation Technical Details: Two hardcoded OAuth client credentials were identified in the platform, both accepted by gw.builder.aqara.com. The tokens for both issues have the attribute. Third Client (app): Exists, with an unknown . The token remains valid after password changes; no restrictions were imposed at issuance. POC Code Timeline 2026-03-13: Researchers discovered these issues and contacted the vendor. 2026-03-30: Researchers made a second contact. 2026-04-08: Vendor fixed various findings and vulnerabilities. 2026-04-20: Confirmed researchers' report. 2026-04-20: Vendor stated the issue was fixed. 2026-06-12: 90-day public disclosure from initial contact. Credits These issues were discovered, documented, and disclosed by Samry Abdoufai. CVE coordination was handled by Tod Beardasley of runZero, Inc. Further Information Additional technical details can be found on GitHub.

Goal Reached Thanks to every supporter — we hit 100%!

Aqara IAM/SSO Gateway Hardcoded OAuth Credentials Enable Unauth Takeover (CVE-2026-50083)