PT-2026-48914

CVE-2026-50090

Published

2026-06-12

Updated

2026-06-13

Description by

CVSS 3.1

9.3

Critical

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Aqara Cloud (affected versions not specified)

Description The OAuth Authorization Endpoint "open-cn.aqara.com/oauth/authorize" is subject to a redirect bypass caused by improper validation of unsafe equivalence in input. This flaw allows for domain matching bypass, which can be leveraged to facilitate phishing attacks and session theft.

Recommendations Disable OAuth integration until a fix is available.

Exploitability

Exploit

Fix

Researchers

Sammy Azdoufal

Tod Beardsley

Vendors

Affected products

Weakness enumeration

CWE-1289: Improper Validation of Unsafe Equivalence in Input

Related identifiers