Aqara IAM/SSO Gateway cross-origin resource sharing

Executive summary #

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

Technical details #

Endpoints under /iam/* reflect the request's Origin header into Access-Control-Allow-Origin and set Access-Control-Allow-Credentials: true. No origin allowlist.

Repro:

POST /iam/ucauth/openapi/login HTTP/1.1
Host: gw-builder.aqara.com
Origin: https://evil.example.com
Content-Type: application/json

{"email":"victim@example.com","password":"x"}

→ Response includes Access-Control-Allow-Origin: https://evil.example.com and Access-Control-Allow-Credentials: true.

Confirmed on /iam/ucauth/openapi/login, /iam/ucauth/sendAuthCode, /iam/ucauth/resetPassword, /iam/ucauth/toUniAuthUrl/google, /iam/oauthToken/aseEncrypt, /iam/oauthToken/aseDecrypt.

Further technical details for this issue can be found at https://github.com/xn0tsa/theres-no-place-like-home

Attacker value #

Any malicious webpage may read SSO responses from the victim's browser session, such as account oracle results, auth codes, and OAuth URLs. This issue combines naturally with CVE-2026-50086 (a cross-origin AES oracle) and CVE-2026-50088 (a developer portal CORS).

Credit #

These issues were discovered, documented, and disclosed by Sammy Azdoufal. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-03-13: Set of issues discovered by the researcher and outreach to the vendor initiated

2026-03-30: Second outreach by the researcher

2026-04-08: Various findings and vulnerabilities remediated by the vendor

2026-04-20: Acknowledged the researcher's reporting

2026-04-20: The vendor stated this issue has been fixed

2026-06-12: This public disclosure (90 days from first contact)

For more details on specific findings and fixes, please see the researcher's website at https://github.com/xn0tsa/theres-no-place-like-home.