CVE-2026-50082

MOYENNE 5.3CVE-2026-50082 · Published 12/06/2026 · updated 26/10/2026

En bref

CVE-2026-50082 est une vulnérabilité MOYENNE (CVSS 5.3) touchant cloud developer portal (aqara).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.27%, plus élevée que 18.5% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
cloud developer portal aqara	`= 2026-04-20`	No fix yet

Description

The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices.

References

xn0tsa/theres-no-place-like-home · Exploit
runzero.com/advisories/aqara-dev-portal-auth-token-2026-50082 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free