Aqara IAM/SSO Gateway Unauthenticated AES Oracle Vulnerability

Vulnerability Overview Vulnerability Name: Aqara unauthenticated AES oracle CVE ID: CVE-2026-50086 CVSS Score: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) (7.5 High) Description: Aqara IAM/SSO Gateway (gw-bui1der.aqara.com) exposes bidirectional AES round-trips, allowing unauthenticated signature key operations. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm." Scope of Impact Affected Product: Aqara IAM/SSO Gateway Attacker Value: An attacker can convert any captured ciphertext (cookies, tokens, structured payloads) into plaintext and generate new ciphertext under the platform key. There is no per-account binding to the oracle. Remediation Remediation Status: On 2026-04-20, Aqara confirmed that the issue has been fixed. Technical Details: ECB mode is confirmed, as identical 16-byte plaintext blocks produce identical ciphertext blocks. Known ciphertext samples were observed (admin - e31cZfgAnrBLWYAvRjKp2A==, Aqara2024 - hBFgM5XndB4JvI615CA==) and tested for round-trips via the decryption endpoint. Further Information: More technical details can be found at GitHub link. POC Code Timeline 2026-03-13: The researcher who discovered the issue first contacted the vendor. 2026-03-30: The researcher followed up with the vendor for the second time. 2026-04-08: The vendor remediated various findings and issues. 2026-04-20: The researcher reported that the issue was confirmed and fixed. 2026-06-12: Public disclosure (90 days after first contact). Credits Discoverer: Sammy Abdoufal Coordinator: Tod Beardsley (runZero, Inc.) Subscription Subscribe Link: Subscribe Now Footer Copyright: © Copyright 2026 runZero, Inc. All Rights Reserved Legal: Legal, Privacy Policy, Do Not Sell or Share My Personal Information, Master Subscription Agreement, Manage Subscriptions Social Media LinkedIn: LinkedIn Twitter: Twitter RSS: RSS Others Cookie Settings: COOKIE SETTINGS Summary This vulnerability involves an unauthenticated AES oracle in the Aqara IAM/SSO Gateway, allowing attackers to perform conversions between ciphertext and plaintext. The issue was resolved on 2026-04-20, and more technical details are available at the GitHub link.

Goal Reached Thanks to every supporter — we hit 100%!

Aqara IAM/SSO Gateway Unauthenticated AES Oracle Vulnerability