CVE-2026-50087: Aqara IAM/SSO Gateway CORS Vulnerability (CVSS 8.2)

Technical summary

CVE-2026-50087 is a Cross-Origin Request Sharing (CORS) misconfiguration in the Aqara IAM/SSO gateway that violates the principle of restrictive cross-domain policies (CWE-942). The gateway fails to properly validate or restrict origins making authenticated requests, allowing an attacker-controlled domain to submit state-changing requests or exfiltrate sensitive data from authenticated sessions. The vulnerability requires user interaction—specifically, the victim must visit an attacker-controlled site while maintaining an active, authenticated session with gw-builder.aqara.com. The network vector is unauthenticated and exploitation complexity is low, making it a practical attack surface for phishing or malware distribution campaigns.

Business impact

This vulnerability exposes organizations and individuals using the Aqara IAM/SSO gateway to account compromise and data theft. An attacker can exploit the CORS flaw to steal authentication tokens, session credentials, or sensitive identity information, potentially gaining persistent access to dependent services and systems that rely on this gateway for identity management. In enterprise environments, a compromised SSO gateway can cascade into lateral movement and access to downstream cloud or on-premises applications. The high confidentiality impact and ability to reach cross-site contexts amplifies the blast radius beyond the gateway itself.

Affected systems

The Aqara IAM/SSO gateway (product designation: aqara iam/sso_gateway, hosted at gw-builder.aqara.com) is affected. Organizations using this gateway for identity and access management, particularly those federating it with other SaaS or on-premises applications, are at risk. No specific version constraints are documented in the source data; verify with Aqara's advisory for affected firmware or deployment versions.

Exploitability

Exploitation is straightforward and does not require privileged access or special technical configuration. An attacker simply crafts a malicious webpage containing JavaScript that triggers cross-origin requests to the Aqara gateway. When a logged-in user visits this page, the browser automatically includes session cookies, allowing the attacker to read or modify data. The attack succeeds only if the user has an active session, but given typical SSO session durations, the window of opportunity is substantial. Public exploit code is not required; standard web techniques suffice.

Remediation

Immediately apply any security updates from Aqara addressing this CORS misconfiguration. Review and restrict the Cross-Origin Resource Sharing (CORS) policy to explicitly whitelist only trusted, necessary domains. Implement Origin header validation and avoid wildcards or overly broad domain patterns. Consider implementing additional controls such as SameSite cookie attributes, Content Security Policy (CSP) headers, and request validation via CSRF tokens. For organizations unable to patch immediately, monitor for suspicious cross-origin requests in web server logs and consider network-level controls to restrict access to the gateway.

Patch guidance

Check Aqara's security advisory for the specific patched version and deployment instructions. Organizations should subscribe to Aqara's security notifications to receive timely patch releases. Test any updates in a non-production environment before rollout, especially if the gateway is integrated with critical identity or access systems. Verify that patched versions properly validate Cross-Origin requests and enforce restrictive CORS policies by default.

Detection guidance

Monitor web server and application logs for HTTP requests with unusual Origin headers, particularly from external or unexpected domains, directed at gw-builder.aqara.com endpoints. Look for patterns of rapid or repeated cross-origin requests that attempt to access sensitive endpoints (e.g., token refresh, user profile updates, privilege escalation). Network intrusion detection systems should flag requests with mismatched Origin and Referer headers. Implement alerting on CORS policy violations or authentication errors that correlate with cross-origin request attempts. In browser developer tools, audit service-to-service integrations to ensure they are not inadvertently exposing endpoints to untrusted origins.

Why prioritize this

This vulnerability merits high priority due to its impact on identity and access management infrastructure. A compromised IAM/SSO gateway is a critical attack vector that can expose downstream systems and user identities. The low barrier to exploitation (no special technical knowledge, no authentication required, only user interaction) and high confidentiality impact (session tokens, personal data, account takeover potential) justify immediate remediation. While the vulnerability is not yet tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, the nature of the flaw makes it a natural target for opportunistic attackers and threat actors focused on identity theft or supply chain compromise.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects the combination of network-based attack surface, low complexity, user interaction as a limiting factor, and significant confidentiality impact. The score appropriately captures the ability of an unauthenticated attacker to exfiltrate sensitive information across trust boundaries. The integrity impact is lower because state-modifying attacks are possible but not the primary concern; confidentiality is the dominant risk. Organizational context matters: if the gateway is exposed to the internet and uses short session timeouts, actual risk is elevated; internal-only deployments reduce practical exploitability.

Frequently asked questions