Aqara unauthenticated AES oracle

Executive summary #

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

Technical details #

The below demonstrates the issue:

POST /iam/oauthToken/aseEncrypt?encryptStr=<plaintext>
POST /iam/oauthToken/aseDecrypt?decryptStr=<base64-ciphertext>

ECB mode confirmed because identical 16-byte plaintext blocks produce identical ciphertext blocks. Known ciphertext samples were observed (admin → o3icZFqAnrbLNYAvMjKpZA==, Aqara@2024 → hBFguW5XxndB4Jv1G15CaA==) and round-trip via the decrypt endpoint.

Combined with CVE-2026-50087, the oracle is callable cross-origin from any browser.

Further technical details for this issue can be found at https://github.com/xn0tsa/theres-no-place-like-home

Attacker value #

This vulnerability allows an attacker to convert any captured ciphertext (cookies, tokens, structured payloads) to plaintext and to forge new ciphertext under the platform's key. There is no per-account binding on the oracle.

Credit #

These issues were discovered, documented, and disclosed by Sammy Azdoufal. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-03-13: Set of issues discovered by the researcher and outreach to the vendor initiated

2026-03-30: Second outreach by the researcher

2026-04-08: Various findings and vulnerabilities remediated by the vendor

2026-04-20: Acknowledged the researcher's reporting

2026-04-20: The vendor stated this issue has been fixed

2026-06-12: This public disclosure (90 days from first contact)

For more details on specific findings and fixes, please see the researcher's website at https://github.com/xn0tsa/theres-no-place-like-home.