CVE-2026-50086

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

June 12, 2026

Last Seen

June 13, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Vulnerability in Aqara IAM/SSO Gateway Exposes Signing Key72.0

The Aqara IAM/SSO gateway (gw-builder.aqara.com) has a critical vulnerability (CVE-2026-50086) that allows unauthorized access to cryptographic operations involving the platform's signing key. This flaw enables attackers to forge authentication tokens without authentication, potentially granting the...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Vulnerability in Aqara IAM/SSO Gateway Exposes Signing Key

Jun 13·2 sources

Related Articles (2)

CVE-2026-50086 AKAOMA CVE VULNERABILITIES / 11h The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).

cve.akaoma.com·Jun 13

CVE-2026-50086 - Exploits & Severity

Related Entities

Zero-day Exploit Aqara CWE-287 - Improper Authentication Cwe-306 - Missing Authentication For Critical Function Cwe-327 - Use Of A Broken Or Risky Cryptographic Algorithm Aqara Iam/sso Gateway