CVE-2026-50084

Name of the Vulnerable Software and Affected Versions Aqara Cloud Production API (affected versions not specified)

Description The Aqara Cloud Production API at the endpoint 'open-cn.aqara.com/v3.0/open/api' fails to properly authorize requests, allowing any valid developer token to access any account. This missing authorization can be combined with other issues to enable a fully unauthenticated remote takeover of affected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.