PT-2026-48910

CVE-2026-50086

Published

2026-06-12

Updated

2026-07-09

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aqara IAM/SSO gateway (affected versions not specified)

Description The IAM/SSO gateway at 'gw-builder.aqara.com' exposes an unauthenticated AES oracle, allowing bidirectional AES round-trips against the platform's signing key. This occurs due to missing authentication for a critical function and the use of a broken or risky cryptographic algorithm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Sammy Azdoufal

Tod Beardsley

Vendors

Affected products

Weakness enumeration

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Related identifiers