PT-2026-48908

CVE-2026-50084

Published

2026-06-12

Updated

2026-07-10

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Aqara Cloud Production API (affected versions not specified)

Description The Aqara Cloud Production API at the endpoint 'open-cn.aqara.com/v3.0/open/api' fails to properly authorize requests, allowing any valid developer token to access any account. This missing authorization can be combined with other issues to enable a fully unauthenticated remote takeover of affected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Sammy Azdoufal

Tod Beardsley

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers