CVE-2026-50086 is a critical flaw in the Aqara IAM/SSO gateway. It exposed AES encrypt and decrypt operations under the platform's key to anyone, in ECB mode. The NVD record scores it 10.0, while the runZero advisory estimates 7.5. runZero reports the vendor said it fixed the issue on 20 April 2026.
What's affected
- Product: Aqara IAM/SSO Gateway at gw-builder.aqara.com, a vendor-hosted service.
- Affected versions: not applicable, since the service is run by the vendor.
- Fixed: per runZero's timeline, the vendor stated the issue was fixed on 20 April 2026. Public disclosure was 12 June 2026.
- Weaknesses: CWE-327, use of a broken or risky cryptographic algorithm, and CWE-306 in the advisory text.
- CVSS in the record: 10.0 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory text quotes its own estimate of 7.5, and the two do not match. Treat the higher score as the cautious number. - Not marked as exploited in CISA KEV.
How to check if you're exposed
This is a vendor-hosted cloud service, so there is no package or version for you to check. The runZero advisory's timeline says the vendor reported the issue fixed on 20 April 2026, before the public disclosure on 12 June 2026.
What you can do on your side:
- Confirm that your Aqara devices and apps are on current versions from the official app stores and the vendor.
- Review your Aqara account for devices, automations, shares or logins you do not recognize.
- Check the vendor's support pages for any statement about this disclosure.
What to do now
- Update the Aqara app and any hub or device firmware to the latest versions the vendor offers.
- Review the devices, rooms, automations and shared users on your Aqara account and remove anything you do not recognize.
- Change your account password and enable any extra sign-in protection the app offers.
- If you run these devices in a business, add the platform to your vendor risk list and ask Aqara for a written statement on remediation.
- Keep smart locks, cameras and hubs on a separate network segment from computers that hold sensitive data.
Why it matters
An oracle is a service that performs a secret operation for whoever asks. If a server will encrypt and decrypt data under its own key without checking who is asking, then any data protected by that key can be read or forged. The advisory says this lets someone turn captured ciphertext into plaintext and create new ciphertext the platform would accept. It also notes that ECB mode shows patterns, because identical blocks produce identical output.
The classes are CWE-327 and CWE-306. Use authenticated encryption modes, bind encrypted values to an account, and never expose raw crypto operations over a public endpoint.
Quick check
Why do the two scores differ?
The NVD record and the advisory text were scored separately. When scores disagree, read the description and plan for the worse reading.
Sources
- runZero advisory
- Researcher write-up (named in the CVE record; not fetched)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
