EUVD-2026-36478
GHSA-fqrj-m2f5-x9pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Aqara developer targets
-
DeliveryHost malicious page with CORS exploit JS
-
ExploitPhish victim into visiting while logged in
-
ExecutionBrowser issues credentialed cross-origin fetch to portal
-
PersistPermissive CORS policy returns sensitive response
-
ImpactScript exfiltrates developer data to attacker server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration CORS policy restriction
|
| Exploitation Conditions | Victim must be authenticated to one of the affected Aqara portals (developer.aqara.com, developer-test.aqara.com, or aiot-test.aqara.com) in the same browser and must visit or be redirected to an attacker-controlled web page during that session - this is the UI:R requirement in the CVSS vector. No attacker-side authentication or network position is needed, but exploitation is limited by the requirement that the portal serve credentialed responses with a permissive Access-Control-Allow-Origin (the misconfigured CORS policy itself is the enabling condition), and by browser SameSite cookie defaults that may mitigate some cross-site credentialed requests depending on how Aqara sets its session cookies. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2) is internally consistent with a CORS abuse: network-reachable, low complexity, no attacker authentication required, but the victim (UI:R) must browse to an attacker page while logged into the portal - a meaningful but very common precondition for phishing-style attacks against developer audiences. Scope:Changed and C:H reflect that the attacker-origin page (one security authority) reads data from the portal (another), with high confidentiality impact on developer account material and low integrity impact (state-changing requests may also be possible against CSRF-unprotected endpoints). The CVE description explicitly labels the CVSS as 'estimated' and no EPSS, KEV, or vendor confirmation is provided in the input, so prioritization should treat this as a credible high-severity disclosure risk but not a mass-exploitation event - closer to a targeted credential/data-theft primitive against Aqara developers. |
| Exploit ScenarioDerived | An attacker registers a lookalike domain, sends a phishing email to Aqara IoT developers pointing at an attacker-controlled page, and when a victim who is logged into developer.aqara.com visits the page, embedded JavaScript issues credentialed fetch() calls to the portal API; the permissive CORS response lets the script read the responses and exfiltrate developer profile data, API keys, or device project metadata to the attacker. The same primitive can be aimed at developer-test.aqara.com and aiot-test.aqara.com where pre-production credentials and test device bindings often live with weaker monitoring. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Cross-origin information disclosure in the Aqara Developer Portal (developer.aqara.com) and its shared test environments (developer-test.aqara.com, aiot-test.aqara.com) allows a malicious website to read authenticated responses from any victim developer who visits it, exposing portal data tied to IoT/smart-home developer accounts. The flaw is a permissive CORS policy (CWE-942) that trusts untrusted origins; runZero disclosed it and no public exploit identified at time of analysis, though the technique is well-known and trivially scriptable.
RemediationAI
No vendor-released patch identified at time of analysis; because these are Aqara-operated SaaS endpoints, remediation is the vendor's responsibility and consists of tightening the Access-Control-Allow-Origin policy on developer.aqara.com, developer-test.aqara.com, and aiot-test.aqara.com to an explicit allowlist of trusted Aqara-owned origins, never reflecting arbitrary Origin headers while Access-Control-Allow-Credentials is true, and ensuring preflight responses do not return wildcard or null origins. Developers using the portal should, until Aqara confirms a fix, log out of the developer console when not actively using it, use a dedicated browser profile for portal access to reduce cross-tab exposure, and avoid clicking untrusted links while authenticated - these are inconvenient but block the user-interaction step the attack depends on. Track the runZero advisory at https://www.runzero.com/advisories/aqara-dev-portal-cors-cve-2026-50088 and the disclosure repository at https://github.com/xn0tsa/theres-no-place-like-home for fix confirmation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected systems are Aqara's web-based developer consoles used to manage smart-home/IoT integrations and API credentials. CWE-942 describes a Cross-Origin Resource Sharing configuration that whitelists untrusted domains or reflects the Origin header while also returning Access-Control-Allow-Credentials: true, defeating the browser's Same-Origin Policy. When the server accepts an attacker-controlled origin and permits credentialed requests, JavaScript on an attacker-hosted page can perform XHR/fetch calls to the portal using the victim's session cookies and read the responses cross-origin - turning what is normally a server-side trust boundary into a client-side one.
Know when Aqara Developer Portal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Network-reachable CORS abuse needs no attacker auth (PR:N) but requires a logged-in victim to visit a malicious page (UI:R); scope changes from attacker origin to portal, exposing sensitive data (C:H) with limited write impact (I:L).
Primary rating from Vendor (runZero).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
Executive ViewAI
A vulnerability in the Aqara Developer Portal (CVE-2026-50088) exposes developer API keys and account credentials to malicious websites. Any developer who visits an attacker-controlled site while logged into the portal can have their credentials stolen, potentially compromising IoT and smart-home deployments that depend on their access tokens.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict portal access to VPN/corporate networks with IP allowlist; (2) Rotate all Aqara API keys immediately and enforce monthly rotation; (3) Disable browser-based portal access-use API-only workflows; (4) Monitor account activity logs for unauthorized changes; (5) Implement network segmentation to isolate developer systems from production IoT infrastructure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB