CVE-2026-50089: Aqara IAM/SSO Gateway Open Redirect Vulnerability (6.1 CVSS)

Technical summary

CVE-2026-50089 is classified as CWE-601 (URL Redirection to Untrusted Site) and stems from insufficient validation of redirect destinations in the Aqara IAM/SSO Gateway. The authentication gateway fails to properly sanitize or allowlist redirect parameters, enabling an attacker to inject an arbitrary URL that the application will redirect users to without warning. The vulnerability is network-accessible (AV:N), requires no special privileges (PR:N), has low attack complexity (AC:L), and depends on user interaction (UI:R). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a score of 6.1 (Medium severity), with scope change indicating potential cross-site impact.

Business impact

Open redirects on authentication gateways pose significant business risk because they undermine user trust in the authentication process itself. Attackers can craft convincing phishing campaigns that leverage Aqara's domain reputation to steal credentials, bypass multi-factor authentication flows, or deliver malware. For organizations using Aqara IAM/SSO as a primary or secondary authentication mechanism, this vulnerability could enable large-scale credential compromise. The reputational damage from users being redirected to malicious sites through your trusted authentication provider is substantial, and incident response costs could be significant if the phishing campaign succeeds at scale.

Affected systems

The vulnerability is specific to the Aqara IAM/SSO Gateway product. Organizations deploying gw-builder.aqara.com as their identity provider or as a federated authentication option are affected. Any user or integration relying on Aqara's gateway for sign-on is potentially exposed if they receive a crafted redirect link. The scope change (S:C) in the CVSS vector indicates the vulnerability may affect resources beyond the vulnerable component itself, suggesting that compromised session tokens or redirects could propagate to downstream services.

Exploitability

Exploitability is straightforward from an attacker perspective: no special access, authentication, or technical sophistication is required. The attacker simply constructs a URL containing a malicious redirect parameter and distributes it via email, messaging, or social media. The user interaction requirement (clicking the link) is low-friction in a phishing context. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of the attack and the high-value target (identity infrastructure) make it a prime candidate for exploitation once public awareness increases. Automated scanning for open redirect parameters is routine in adversary reconnaissance.

Remediation

Organizations should immediately review whether they are using the Aqara IAM/SSO Gateway in production and prioritize patching or disabling the service pending a vendor patch. The primary remediation is to upgrade to a patched version once Aqara releases one; verify the patch version against the official Aqara security advisory. Interim compensating controls include implementing a strict allowlist of permitted redirect domains within the gateway configuration (if configurable), deploying a Web Application Firewall (WAF) rule to detect and block redirect parameter injection attempts, and educating users on verifying URLs before entering credentials. If Aqara is used only for non-critical authentication or can be temporarily replaced with an alternative provider, disabling it is the most effective short-term measure.

Patch guidance

Monitor the Aqara security advisories and vendor channels for a patched release. Once available, apply the patch to all instances of the IAM/SSO Gateway in your environment. Verify the patch version against the official advisory before deploying. If Aqara has not yet released a patch, contact their support team for a timeline and interim guidance. Given the medium severity and the widespread impact on authentication infrastructure, prioritize this for testing and deployment within your standard change management process, but do not delay if users are at active risk.

Detection guidance

Monitor HTTP referrer logs and proxy/firewall logs for redirect traffic from gw-builder.aqara.com to unexpected external domains. Configure SIEM rules to alert on URL parameters commonly associated with redirects (e.g., 'redirect_uri', 'return_to', 'next') containing non-Aqara or suspicious domains. Analyze authentication logs for anomalous session origination (e.g., logins from unexpected locations immediately following a redirect event). Web access logs should show unusual 30x HTTP responses with Location headers pointing away from Aqara's domain. Implement endpoint detection and response (EDR) monitoring for credential-theft patterns that may follow a redirect-based phishing campaign (e.g., unusual LDAP queries, credential enumeration, or lateral movement from initially compromised accounts).

Why prioritize this

Although the CVSS score is 6.1 (Medium), this vulnerability should be treated as higher priority due to its position in the authentication chain. A compromise of the SSO/IAM gateway affects organizational security posture across all dependent applications and services. The ease of exploitation and the high likelihood that attackers will craft targeted phishing campaigns using this vector justify accelerated patching. The lack of KEV listing should not delay action; this is an ideal target for opportunistic phishing-at-scale once public disclosure spreads.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability with low complexity and user-interaction dependency, but limited direct impact (confidentiality and integrity compromise only, no availability impact). The scope-change flag (S:C) indicates potential cross-boundary effects. However, the contextual risk is higher than the base score suggests because the vulnerability exists on identity infrastructure, which is a high-value target. The absence of availability impact (A:N) and the requirement for user interaction prevent a critical rating, but the authentication-layer position and phishing applicability elevate practical risk above the numerical score.

Frequently asked questions