What is the CVSS score of EUVD-2026-36474?

EUVD-2026-36474 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Aqara Cloud API are affected by EUVD-2026-36474?

Aqara Cloud Production API contains a broken authorization vulnerability allowing any developer with a valid API token to access and control arbitrary user accounts, completely bypassing tenant…. A patch is available.

How to fix or mitigate EUVD-2026-36474?

Within 24 hours: Request emergency patch timeline from Aqara; audit all developer API token activity in the past 90 days for indicators of abuse; prepare full inventory of Aqara-connected devices and affected user accounts. Within 7 days: If no patch timeline provided, revoke and rotate all developer API tokens; enforce API token scope restrictions to minimum necessary permissions; implement enhanced monitoring for cross-account API requests. Within 30 days: Evaluate alternative smart-home platforms; execute patch deployment immediately upon release by Aqara; rotate all API tokens again post-patch; conduct forensic review of token usage for indicators of compromise.

Aqara Cloud API EUVD-2026-36474

| CVE-2026-50084 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 runZero

GHSA-4mvx-j4wr-wqrc

Authentication Bypass Cloud Production Api Aqara

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

Vendor (runZero) PRIMARY

CRITICAL

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

9.6 CRITICAL

Internet-facing API (AV:N), no special conditions (AC:L), only a self-registered developer token needed (PR:L), no user interaction, cross-tenant scope change with full read/write on victim accounts but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 17:52 NVD

CRITICAL MEDIUM

CVSS changed

Jul 09, 2026 - 17:52 NVD

9.6 (CRITICAL) 6.5 (MEDIUM)

Severity Changed

Jul 09, 2026 - 17:52 NVD

CRITICAL MEDIUM

CVSS changed

Jul 09, 2026 - 17:52 NVD

9.6 (CRITICAL) 6.5 (MEDIUM)

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:21 vuln.today

DescriptionNVD

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

AnalysisAI

Broken authorization in the Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) allows any valid developer token to operate against arbitrary user accounts, breaking tenant isolation across the platform. Discovered and disclosed by runZero, the issue stems from missing authorization checks (CWE-862) and, when chained with CVE-2026-50082/50083/50085, enables fully unauthenticated remote takeover of affected smart-home devices. No public exploit identified at time of analysis, though a related researcher repository is referenced in the advisory.

Technical ContextAI

The affected component is Aqara's Cloud Production API, a multi-tenant REST endpoint at open-cn.aqara.com/v3.0/open/api that backs Aqara's smart-home ecosystem (hubs, sensors, cameras, locks) and is consumed by third-party developer integrations using OAuth-style developer tokens. The root cause is CWE-862 Missing Authorization: the server authenticates the bearer token but never checks that the token's owning developer/tenant is authorized to act on the target accountId/userId supplied in the request, so any low-privileged developer credential becomes a cross-tenant master key. The CPE cpe:2.3:a:aqara:cloud_production_api:*:*:*:* indicates the flaw is in the cloud service itself rather than a specific firmware build, meaning all customers of the platform were exposed simultaneously until the vendor pushed a server-side fix.

RemediationAI

Because the defect resides in Aqara's hosted API, end users cannot patch it directly; remediation depends on a server-side authorization fix deployed by Aqara, and no vendor-released patch is independently confirmed from the supplied references - consult the runZero advisory at https://www.runzero.com/advisories/aqara-api-access-cve-2026-50084 and Aqara's developer portal for the current status. As compensating controls until vendor confirmation, account holders should rotate or revoke any third-party developer integrations they previously granted (reducing the population of tokens that could abuse the flaw against their account), unlink the Aqara cloud account from any non-essential ecosystems, and where feasible operate Aqara hubs in local/LAN-only mode (Aqara hub local control), accepting the trade-off of losing remote access and voice-assistant integrations; network operators monitoring outbound traffic should alert on unexpected API calls to open-cn.aqara.com from unmanaged developer environments. Because this CVE chains with CVE-2026-50082/50083/50085 to enable device takeover, prioritize firmware updates for Aqara devices once the vendor publishes patched releases.