Aqara/Lumi IoT Platform: 10 CVEs (Auth Bypass, Hardcoded Keys, SSRF) with POCs

Vulnerability Overview This report details ten Common Vulnerabilities and Exposures (CVEs) affecting the Aqara/Lumi IoT Cloud Platform. These vulnerabilities span several areas, including the developer portal, OAuth client credentials, production API signature schemes, Board IoT device debugging APIs, unencrypted AES encryption/decryption, production SSO gateways, CORS configurations on the developer portal, SSO open redirects, OAuth redirect URL verification bypasses, and hardcoded encryption keys within the mobile SDK. Scope of Impact Developer Portal: Anyone can register a developer account using any email address and obtain a valid Appid and Keyid. OAuth Client Credentials: Hardcoded OAuth client credentials exist, allowing the issuance of tokens valid for up to 57 years. Production API Signature Scheme: The scheme accepts any developer Appid, enabling cross-account access. Board IoT Device Debugging API: Lacks authentication, allowing the sending of arbitrary MQTT commands. Unencrypted AES Encryption/Decryption: AES encryption and decryption operations are performed without proper encryption. Production SSO Gateway: Configured to allow CORS from any origin. CORS on Developer Portal: Configured to allow CORS from any origin. SSO Open Redirect: Contains an open redirect vulnerability in the Single Sign-On (SSO) flow. OAuth Redirect URL Verification Bypass: The verification for OAuth redirect URLs can be bypassed. Hardcoded Encryption Key in Mobile SDK: The mobile SDK contains a hardcoded AES key used for camera authorization, device pairing, and content encryption. Remediation Developer Portal: Implement strict email validation and approval processes. OAuth Client Credentials: Remove hardcoded OAuth client credentials and adopt secure key management practices. Production API Signature Scheme: Strengthen API signature verification to ensure only authorized developer Appids can perform cross-account access. Board IoT Device Debugging API: Add authentication mechanisms to restrict access to the Board IoT device debugging API. Unencrypted AES Encryption/Decryption: Use secure encryption algorithms and robust key management practices. Production SSO Gateway: Restrict CORS policies to allow only trusted origins. CORS on Developer Portal: Restrict CORS policies to allow only trusted origins. SSO Open Redirect: Fix the SSO open redirect vulnerability to ensure the security of redirect URLs. OAuth Redirect URL Verification Bypass: Enhance validation for OAuth redirect URLs to prevent bypasses. Hardcoded Encryption Key in Mobile SDK: Remove hardcoded AES keys and implement secure key management practices. POC Code CVE-2026-50082 — Register a Developer Account With Anyone's Email CVE-2026-50083 — test1:123456 Buys You a 57-Year Token CVE-2026-50084 — One Appid Reads Every Device Additional Findings Additional Findings (No CVE): Includes extra operational side risks (such as CRM, Spring Boot Actuator, IAM Gateway, etc.). These risks were not assigned CVEs but were documented in the disclosure timeline. Disclosure Timeline Initial Contact: March 13, 2026 Planned Public Disclosure: June 11, 2026 Aqara's Response In a response dated June 11, 2026, Aqara stated that these vulnerabilities relate to the testing environment rather than the production system. However, this response did not fully address all issues, and some vulnerabilities still require further remediation. If You Own Aqara Devices Users are advised to update their device firmware as soon as possible and follow the remediation steps outlined above to ensure device security.

Goal Reached Thanks to every supporter — we hit 100%!

Aqara/Lumi IoT Platform: 10 CVEs (Auth Bypass, Hardcoded Keys, SSRF) with POCs

More from this source