CVE-2026-50083 is a critical (CVSS 9.1) flaw in the Aqara IAM/SSO Gateway, a cloud service. It accepted hard-coded OAuth client credentials that issued powerful tokens. runZero's advisory says the vendor reported it fixed on 20 April 2026. Update your Aqara apps and review your account.
What's affected
- Product: Aqara IAM/SSO Gateway at gw-builder.aqara.com, a vendor-hosted service.
- Affected versions: not applicable, since the service is run by the vendor.
- Fixed: the runZero timeline says the vendor stated the issue was fixed on 20 April 2026, and public disclosure followed on 12 June 2026.
- Weakness: CWE-798, use of hard-coded credentials.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. - Published 12 June 2026. Not marked as exploited in CISA KEV.
runZero describes this as one step in a chain with CVE-2026-50082, CVE-2026-50084 and CVE-2026-50085, which together could allow remote takeover of devices without authentication.
How to check if you're exposed
This is a vendor-hosted cloud service, so there is no package or version for you to check. The runZero advisory's timeline says the vendor reported the issue fixed on 20 April 2026, before the public disclosure on 12 June 2026.
What you can do on your side:
- Confirm that your Aqara devices and apps are on current versions from the official app stores and the vendor.
- Review your Aqara account for devices, automations, shares or logins you do not recognize.
- Check the vendor's support pages for any statement about this disclosure.
What to do now
- Update the Aqara app and any hub or device firmware to the latest versions the vendor offers.
- Review the devices, rooms, automations and shared users on your Aqara account and remove anything you do not recognize.
- Change your account password and enable any extra sign-in protection the app offers.
- If you run these devices in a business, add the platform to your vendor risk list and ask Aqara for a written statement on remediation.
- Keep smart locks, cameras and hubs on a separate network segment from computers that hold sensitive data.
Why it matters
An OAuth client credential identifies an application to the server. If the same credential is built into the platform and accepted everywhere, then it stops being a secret and becomes a published key. The advisory says the accepted credentials produced tokens with broad scope, and that those tokens were a needed step in a longer chain against the platform.
The class is CWE-798. The standard answer is to issue credentials per client, keep them out of source and builds, and give them narrow scope and short lives. Teams that run their own platforms can scan repositories for committed secrets in the same way.
Quick check
Do I need to do anything if the vendor already fixed it?
Mostly housekeeping. Keep your apps and firmware current and review your account for anything unfamiliar.
Sources
- runZero advisory
- Researcher write-up (named in the CVE record; not fetched)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
