EUVD-2026-36479
GHSA-x2pr-g8vf-qfcp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Public cloud SSO endpoint, no auth needed, scope changes to attacker domain; user must click link; no availability impact from redirect alone.
Primary rating from Vendor (runZero).
CVSS VectorVendor: runZero
Lifecycle Timeline
2DescriptionCVE.org
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 Medium), which can be used to set up a phishing attack.
AnalysisAI
Open redirect in the Aqara IAM/SSO Gateway (gw-builder.aqara.com) allows remote unauthenticated attackers to craft Aqara-domain URLs that silently forward victims to attacker-controlled sites, enabling highly credible phishing campaigns targeting Aqara users and connected IoT ecosystem accounts. The vulnerability is particularly impactful in an SSO context because users are trained to trust authentication-domain URLs, dramatically lowering phishing detection rates. A public proof-of-concept repository exists on GitHub; no confirmed active exploitation per CISA KEV at time of analysis.
Technical ContextAI
Aqara operates a cloud-hosted Identity and Access Management and Single Sign-On gateway at gw-builder.aqara.com, serving as the authentication broker for Aqara's smart home and IoT device ecosystem. CWE-601 (URL Redirection to Untrusted Site) manifests when an application accepts a caller-supplied URL parameter and uses it as a redirect destination without validating it against a whitelist of trusted origins. In SSO and OAuth flows, redirect_uri and return_to parameters are structurally expected and commonly whitelisted at the domain level rather than per-URI, making this attack surface endemic to identity providers that do not enforce strict destination validation. The CPE cpe:2.3:a:aqara:aqara_iam/sso_gateway:*:*:*:*:*:*:*:* covers all versions of the gateway, suggesting this is a design-level flaw rather than a regression in a specific release. Because the vulnerable endpoint is cloud-hosted infrastructure rather than an on-premises product, remediation is entirely in Aqara's hands.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the CPE wildcard and absence of a fixed-version reference indicate Aqara has not yet published a confirmed remediation. Because the gateway is cloud-hosted, the fix must be applied server-side by Aqara by implementing a strict allowlist of valid post-authentication redirect destinations rather than accepting arbitrary caller-supplied URLs. End users and organizations cannot self-patch. Compensating controls include: training users to verify the final destination URL before entering credentials (trade-off: low efficacy against casual users); blocking non-essential access to gw-builder.aqara.com at network boundaries where Aqara SSO is not operationally required (trade-off: may disrupt legitimate Aqara device authentication flows); and deploying phishing-resistant MFA such as hardware security keys for all Aqara accounts to limit credential compromise impact even if a user is redirected to a phishing page. Monitor the runZero advisory at https://www.runzero.com/advisories/aqara-sso-open-redirect-cve-2026-50089 for patch confirmation.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today