Loading story…
Researcher Sammy Azdoufal publicly disclosed a broad set of vulnerabilities in Aqara’s cloud platform, including CVE-2026-50084, a critical authorization flaw in the production API that allowed any valid developer token to access user-scoped endpoints for arbitrary accounts. The issue, rated CVSS 9.6 and classified as CWE-862, affected open-cn.aqara.com/v3.0/open/api and stemmed from missing per-account authorization checks rather than the platform’s MD5-based request-signing scheme. Aqara said the flaw was fixed in April, before public disclosure, but the researcher reported mixed remediation status across the wider set of findings.
The disclosure tied ten CVEs to Aqara cloud, mobile, and developer systems, including hardcoded OAuth credentials in the IAM/SSO gateway (CVE-2026-50083), an unauthenticated MQTT debug interface in Aqara Board (CVE-2026-50085), an unauthenticated AES oracle (CVE-2026-50086), permissive CORS issues (CVE-2026-50087, CVE-2026-50088), an OAuth redirect_uri validation bypass (CVE-2026-50090), and hardcoded cryptographic keys in the Aqara Home Android SDK (CVE-2026-50091). According to the advisory and CVE records, several of these flaws could be chained with CVE-2026-50084 to achieve fully unauthenticated remote takeover of affected devices, while the GitHub disclosure also alleged additional exposures in Aqara back-office infrastructure and disputed the vendor’s claim that the impact was limited to test environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-12, CVE-2026-50091 was recorded for hard-coded cryptographic keys in Aqara Home Android 6.0.0 and white-label clients using the same library. The entry said the flaw could severely impact confidentiality and integrity.
A new vulnerability, CVE-2026-50090, was recorded on 2026-06-12 for Aqara's OAuth authorization endpoint at open-cn.aqara.com/oauth/authorize. The issue was described as a redirect_uri validation bypass caused by lax domain matching.
On 2026-06-12, CVE-2026-50088 was recorded for a cross-origin resource sharing weakness affecting developer.aqara.com and related test environments. The entry said the policy was permissive toward untrusted domains.
A new vulnerability entry, CVE-2026-50087, was recorded on 2026-06-12 for a permissive cross-origin resource sharing policy on Aqara's IAM/SSO gateway. The issue affected gw-builder.aqara.com.
On 2026-06-12, CVE-2026-50086 was recorded for the Aqara IAM/SSO gateway at gw-builder.aqara.com. The entry described unauthenticated access to bidirectional AES operations against the platform's signing key.
A new CVE entry, CVE-2026-50085, was added on 2026-06-12 for an authentication flaw in the Aqara Board service at op-test.aqara.com. The service reportedly accepted arbitrary MQTT command payloads and forwarded them without authentication.
On 2026-06-12, CVE-2026-50084 was publicly documented as a critical missing-authorization flaw in the Aqara Cloud Production API. The advisory said any valid developer token could access user-scope endpoints for arbitrary accounts and that the issue could be chained with other Aqara flaws.
A new CVE entry for CVE-2026-50083 was added on 2026-06-12 covering hardcoded OAuth client credentials in the Aqara IAM/SSO Gateway at gw-builder.aqara.com. The entry said the flaw could contribute to a chained unauthenticated remote takeover scenario.
On 2026-06-11, researcher Sammy Azdoufal published a GitHub report disclosing ten CVEs affecting Aqara's cloud platform, including a four-step unauthenticated chain that allegedly enabled remote device takeover. The report also said Aqara had acknowledged 26 of 27 findings, marked them fixed in April 2026, and that several issues remained vulnerable or only partially resolved as of disclosure.
The vendor said the authorization flaw tracked as CVE-2026-50084 was fixed on 2026-04-20. The issue affected the Aqara Cloud Production API and allowed any valid developer token to access arbitrary Aqara accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
runzero.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Severe vulnerabilities in Meari Technology’s white-label IoT platform exposed more than 1 million baby monitors and security cameras across 118 countries, affecting devices sold under hundreds of brands on marketplaces including Amazon. Researcher Sammy Azdoufal reported that weaknesses in Meari’s hardware, mobile apps, SDKs, cloud services, and backend infrastructure allowed unauthorized access to MQTT message streams, device data, user email addresses, rough location information, WAN IP addresses, and real-time camera activity. Publicly accessible motion-alert images stored on Alibaba OSS and missing per-device access controls on Meari’s EMQX-based IoT platform left sensitive household photos and notifications exposed, raising particular concern for devices deployed in bedrooms, nurseries, and other private spaces. Meari acknowledged that attackers could intercept messages without authorization and disclosed a potential remote code execution risk linked to weak passwords on a scheduled task platform. The company said it shut down the exposed EMQX platform, changed credentials, and advised firmware upgrades for devices running versions below `3.0.0`, while Azdoufal said five CVEs were coordinated with runZero and CISA under `VU#579666`. A published disclosure timeline alleges Meari delayed responding, minimized some findings, used backdated advisories that covered only part of the issues, and failed to directly notify affected EU users or confirm GDPR breach reporting; Azdoufal later received a €24,000 bug bounty after an agreement preserved his right to publish the findings.
Jun 29, 2026
Gardyn disclosed two high-severity vulnerabilities affecting its cloud API, mobile application, and device firmware that could allow unauthorized access to sensitive data without prior authentication. **CVE-2026-28766** is a `CWE-306` missing-authentication flaw in a user-facing cloud endpoint that returns all registered user account information even when no authentication is provided, creating a direct path to broad data exposure over the network with no user interaction required. A second issue, **CVE-2025-10681**, is a `CWE-798` hard-coded credentials flaw in the Gardyn mobile app and device firmware. The embedded storage credentials reportedly grant overly broad permissions and do not expire within a reasonable time, potentially enabling unauthorized access to production storage containers and increasing the risk of confidentiality loss. Both records were published through CISA-linked advisories and vendor security references, indicating coordinated disclosure across federal and vendor channels.
Jun 29, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026