EUVD-2026-36478
GHSA-fqrj-m2f5-x9pj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Network-reachable CORS abuse needs no attacker auth (PR:N) but requires a logged-in victim to visit a malicious page (UI:R); scope changes from attacker origin to portal, exposing sensitive data (C:H) with limited write impact (I:L).
Primary rating from Vendor (runZero).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
AnalysisAI
Cross-origin information disclosure in the Aqara Developer Portal (developer.aqara.com) and its shared test environments (developer-test.aqara.com, aiot-test.aqara.com) allows a malicious website to read authenticated responses from any victim developer who visits it, exposing portal data tied to IoT/smart-home developer accounts. The flaw is a permissive CORS policy (CWE-942) that trusts untrusted origins; runZero disclosed it and no public exploit identified at time of analysis, though the technique is well-known and trivially scriptable.
Technical ContextAI
The affected systems are Aqara's web-based developer consoles used to manage smart-home/IoT integrations and API credentials. CWE-942 describes a Cross-Origin Resource Sharing configuration that whitelists untrusted domains or reflects the Origin header while also returning Access-Control-Allow-Credentials: true, defeating the browser's Same-Origin Policy. When the server accepts an attacker-controlled origin and permits credentialed requests, JavaScript on an attacker-hosted page can perform XHR/fetch calls to the portal using the victim's session cookies and read the responses cross-origin - turning what is normally a server-side trust boundary into a client-side one.
RemediationAI
No vendor-released patch identified at time of analysis; because these are Aqara-operated SaaS endpoints, remediation is the vendor's responsibility and consists of tightening the Access-Control-Allow-Origin policy on developer.aqara.com, developer-test.aqara.com, and aiot-test.aqara.com to an explicit allowlist of trusted Aqara-owned origins, never reflecting arbitrary Origin headers while Access-Control-Allow-Credentials is true, and ensuring preflight responses do not return wildcard or null origins. Developers using the portal should, until Aqara confirms a fix, log out of the developer console when not actively using it, use a dedicated browser profile for portal access to reduce cross-tab exposure, and avoid clicking untrusted links while authenticated - these are inconvenient but block the user-interaction step the attack depends on. Track the runZero advisory at https://www.runzero.com/advisories/aqara-dev-portal-cors-cve-2026-50088 and the disclosure repository at https://github.com/xn0tsa/theres-no-place-like-home for fix confirmation.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today