What is the CVSS score of CVE-2026-50087?

CVE-2026-50087 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Aqara IAM/SSO Gateway are affected by CVE-2026-50087?

Aqara's cloud identity gateway (gw-builder.aqara.com) contains a CORS misconfiguration enabling unauthenticated attackers to steal authentication credentials and user data from logged-in Aqara…. A patch is available.

How to fix or mitigate CVE-2026-50087?

Within 24 hours: Identify all internal systems and users accessing Aqara IAM services; enforce multi-factor authentication on all Aqara accounts; implement WAF rules to block suspicious cross-origin requests to gw-builder.aqara.com. Within 7 days: Obtain vendor advisory and patch timeline from Aqara Security; deploy Content Security Policy headers on applications that integrate Aqara identity services to restrict token exfiltration; monitor authentication logs for anomalous cross-origin access patterns. Within 30 days: Evaluate and plan migration to alternative IAM solutions if Aqara does not release a patch; implement network segmentation to isolate Aqara-dependent systems from untrusted networks.

Aqara IAM/SSO Gateway CVE-2026-50087

EUVD-2026-36477 MEDIUM

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-06-12 runZero

GHSA-x4g8-9rgj-rr4r

Cors Misconfiguration Information Disclosure Aqara Iam Sso Gateway

6.1

CVSS 3.1 · NVD

Severity by source

Vendor (runZero) PRIMARY

HIGH

qualitative

NVD

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

8.2 HIGH

Browser-driven cross-origin attack needs no Aqara credentials (PR:N) but requires victim visit (UI:R); credentialed CORS bypass crosses the SSO trust boundary (S:C) exposing tokens (C:H) with limited write (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (runZero).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 16:37 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 16:37 NVD

8.2 (HIGH) 6.1 (MEDIUM)

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:23 vuln.today

DescriptionNVD

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

AnalysisAI

Cross-origin information disclosure in the Aqara IAM/SSO gateway (gw-builder.aqara.com) allows attacker-controlled web origins to read authenticated user data by exploiting a permissive CORS policy that trusts arbitrary domains. The flaw, scored CVSS 8.2 with scope change due to credential exposure crossing the browser/identity-provider trust boundary, affects all users of Aqara's centralized smart-home identity service and can be triggered when a logged-in victim visits an attacker-hosted page. A public GitHub repository (xn0tsa/theres-no-place-like-home) is linked from the advisory, so publicly available exploit code exists, though no CISA KEV listing or EPSS signal is provided.

Technical ContextAI

The vulnerability sits in the gw-builder.aqara.com endpoint, which is Aqara's IAM/SSO gateway - the OAuth/single-sign-on broker used by Aqara cloud services and mobile apps to authenticate users and issue session tokens for smart-home device control. CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) typically manifests as an Access-Control-Allow-Origin header that reflects the requesting Origin combined with Access-Control-Allow-Credentials: true, or as a wildcard policy that accepts arbitrary subdomains. When this misconfiguration is present on an SSO endpoint that returns tokens, profile data, or device-binding identifiers, any cross-origin script can read responses that should be confined to first-party Aqara web properties, effectively bypassing the same-origin policy that browsers rely on to isolate authenticated sessions. The single affected CPE (cpe:2.3:a:aqara:aqara_iam/sso_gateway) is a hosted cloud service rather than installable software, so all users are simultaneously affected until Aqara remediates server-side.

RemediationAI

No vendor-released patch identified at time of analysis, and because the affected component is a cloud-hosted SSO endpoint operated by Aqara, end users cannot apply a fix directly - monitor https://www.runzero.com/advisories/aqara-iam-sso-cors-cve-2026-50087 and Aqara security communications for confirmation that gw-builder.aqara.com has been reconfigured to enforce a strict allowlist of first-party origins with Access-Control-Allow-Credentials handled correctly. Compensating controls for security-conscious users include signing out of the Aqara web portal when not actively using it (limits the window in which a malicious cross-origin page can read authenticated responses, at the cost of repeated logins), using a dedicated browser profile or container for Aqara sessions to isolate cookies (reduces cross-site exposure but requires user discipline), and blocking gw-builder.aqara.com from non-Aqara browser contexts via extensions such as uMatrix or NoScript (effective but high-friction). Organizations deploying Aqara at scale should consider network egress rules that restrict employee browsers from loading untrusted third-party content while Aqara sessions are active, though this is impractical outside hardened environments.