EUVD-2026-36476
GHSA-3897-2crh-vgmr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network oracle (AV:N/AC:L/PR:N) exposes the signing key enabling token forgery (I:H) and key/data disclosure (C:H); no evidence of availability impact, so A:N.
Primary rating from Vendor (runZero).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
AnalysisAI
Unauthenticated cryptographic oracle exposure in the Aqara IAM/SSO gateway (gw-builder.aqara.com) lets remote attackers submit data for bidirectional AES encrypt/decrypt operations performed with the platform's signing key, with no authentication required. Because the same key that signs SSO tokens can be exercised as an oracle, an attacker can recover protected material and potentially forge or manipulate signed authentication tokens (tagged Authentication Bypass). Publicly available exploit code exists (SSVC exploitation=poc) and CISA's SSVC rates it automatable with total technical impact, though EPSS remains very low at 0.06%.
Technical ContextAI
The affected component is Aqara's Identity and Access Management / Single Sign-On gateway, a vendor-hosted cloud endpoint (gw-builder.aqara.com, CPE cpe:2.3:a:aqara:aqara_iam/sso_gateway) that underpins account authentication for Aqara's smart-home ecosystem. The root cause is dual: CWE-306 (Missing Authentication for Critical Function) exposes a sensitive cryptographic operation to anonymous callers, and CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) reflects that raw AES round-trips against the platform signing key are reachable without integrity protection or access control. Exposing an encrypt/decrypt oracle keyed with a signing secret is dangerous because SSO systems rely on that key's secrecy to guarantee token authenticity; an oracle that both encrypts and decrypts attacker-chosen input undermines the confidentiality of the key material and the trustworthiness of every token it protects.
RemediationAI
Because the flaw resides in a vendor-operated cloud service, remediation is server-side and controlled by Aqara: patch available per vendor advisory (no specific fix version is published, consistent with a hosted-service fix). Consult the runZero advisory (https://www.runzero.com/advisories/aqara-unauth-aes-oracle-cve-2026-50086) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-50086) to confirm the endpoint has been remediated. Customers cannot self-patch the cloud gateway, so compensating actions are limited to Aqara-side controls: require authentication on the AES/oracle endpoint, rotate the platform signing key that was exposed to the oracle (a key that has served as an oracle should be treated as compromised - rotation invalidates existing sessions and forces re-login, the primary side effect), and separate the signing key from any encrypt/decrypt service function so signing material is never reachable through a data-transformation endpoint. Downstream operators depending on Aqara SSO should watch for and, where possible, invalidate potentially forged tokens after the vendor confirms key rotation.
More in Aqara Iam Sso Gateway
View allCross-origin information disclosure in the Aqara IAM/SSO gateway (gw-builder.aqara.com) allows attacker-controlled web o
Open redirect in the Aqara IAM/SSO Gateway (gw-builder.aqara.com) allows remote unauthenticated attackers to craft Aqara
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today