CVE-2026-50086 AKAOMA CVE VULNERABILITIES / 11h The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

Back cve.akaoma.com

CVE-2026-50086 AKAOMA CVE VULNERABILITIES / 11h The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

cve.akaoma.com • June 13, 2026

Share: View original

10.0 /10 Critical Risk As a catastrophic security flaw, CVE-2026-50086 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-50086 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Aqara IAM/SSO Gateway Exposes Signing Key The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a critical vulnerability (CVE-2026-50086) that allows unauthorized access to cryptographic operations involving the platform's signing key. This flaw enables attackers to forge authentication tokens without authentication, potentially granting them unauthorized access to the platform. The vulnerability is classified as a 'Missing Authentication for Critical Function' and 'Use of a Broken or Risky Cryptographic Algorithm.' The CVSS score is estimated at 7.5, indicating a high severity. There is currently no evidence of active exploitation or a public proof-of-concept. Security patches have been released, and organizations are advised to implement authentication controls and review access logs. The vulnerability was first published on June 12, 2026. 2 sources 72

Extracted Entities

CVEs (1)

CWE Weaknesses (2)

Cwe-306 - Missing Authentication For Critical Function Cwe-327 - Use Of A Broken Or Risky Cryptographic Algorithm

Domains (1)

gw-builder.aqara.com

Platforms (1)

Aqara Iam/sso Gateway