Aqara Developer Portal CVE-2026-50088

Victim must be authenticated to one of the affected Aqara portals (developer.aqara.com, developer-test.aqara.com, or aiot-test.aqara.com) in the same browser and must visit or be redirected to an attacker-controlled web page during that session - this is the UI:R requirement in the CVSS vector. No attacker-side authentication or network position is needed, but exploitation is limited by the requirement that the portal serve credentialed responses with a permissive Access-Control-Allow-Origin (the misconfigured CORS policy itself is the enabling condition), and by browser SameSite cookie defaults that may mitigate some cross-site credentialed requests depending on how Aqara sets its session cookies.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2) is internally consistent with a CORS abuse: network-reachable, low complexity, no attacker authentication required, but the victim (UI:R) must browse to an attacker page while logged into the portal - a meaningful but very common precondition for phishing-style attacks against developer audiences. Scope:Changed and C:H reflect that the attacker-origin page (one security authority) reads data from the portal (another), with high confidentiality impact on developer account material and low integrity impact (state-changing requests may also be possible against CSRF-unprotected endpoints). The CVE description explicitly labels the CVSS as 'estimated' and no EPSS, KEV, or vendor confirmation is provided in the input, so prioritization should treat this as a credible high-severity disclosure risk but not a mass-exploitation event - closer to a targeted credential/data-theft primitive against Aqara developers.

An attacker registers a lookalike domain, sends a phishing email to Aqara IoT developers pointing at an attacker-controlled page, and when a victim who is logged into developer.aqara.com visits the page, embedded JavaScript issues credentialed fetch() calls to the portal API; the permissive CORS response lets the script read the responses and exfiltrate developer profile data, API keys, or device project metadata to the attacker. The same primitive can be aimed at developer-test.aqara.com and aiot-test.aqara.com where pre-production credentials and test device bindings often live with weaker monitoring.