CVE-2026-50089: Aqara IAM/SSO Gateway Open Redirect Flaw

CVE-2026-50089 Overview

CVE-2026-50089 is an open redirect vulnerability in the Aqara IAM/SSO Gateway (gw-builder.aqara.com). The flaw maps to CWE-601: URL Redirection to Untrusted Site. Attackers can craft URLs that appear to originate from the trusted Aqara single sign-on (SSO) domain but redirect victims to attacker-controlled destinations. The vulnerability requires user interaction and is primarily useful as a building block for phishing and credential theft campaigns targeting Aqara smart home customers.

Critical Impact
An attacker can abuse the trusted Aqara SSO domain to redirect authenticated users to attacker-controlled phishing pages, enabling credential and session theft.

Affected Products

Aqara IAM/SSO Gateway (gw-builder.aqara.com)
Aqara identity and single sign-on service endpoints
Downstream Aqara web applications relying on the SSO gateway for authentication flows

Discovery Timeline

2026-06-12 - CVE-2026-50089 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50089

Vulnerability Analysis

The Aqara IAM/SSO Gateway accepts a redirect target parameter as part of its authentication flow without enforcing a strict allowlist of trusted destinations. An attacker can craft a URL on the legitimate gw-builder.aqara.com host that forwards the browser to any external site after the SSO interaction. Because the initial link points to the genuine Aqara domain, users and email gateways are more likely to treat it as safe.

This is a classic open redirect rather than a server-side compromise. The integrity and confidentiality impact is limited to the user session, but the trust transfer from a known SSO domain to an attacker-controlled page makes it well suited for phishing. The vulnerability does not directly grant code execution or data exfiltration from Aqara infrastructure.

Root Cause

The root cause is insufficient validation of a user-supplied redirect parameter in the SSO authentication flow. The gateway honors arbitrary destination URLs supplied through query parameters instead of restricting redirection targets to a static list of approved Aqara domains.

Attack Vector

Exploitation proceeds over the network and requires the victim to click a crafted link. The attacker sends a phishing email, message, or web link containing a URL on gw-builder.aqara.com with a manipulated redirect parameter. After the SSO step, the browser is forwarded to an attacker-controlled site that mimics Aqara login pages or delivers further payloads. Proof-of-concept details are published in the GitHub PoC repository and the RunZero security advisory.

The vulnerability manifests in the SSO redirect handler. No verified exploit code is reproduced here; see the linked advisory for technical details.

Detection Methods for CVE-2026-50089

Indicators of Compromise

Outbound HTTP requests to gw-builder.aqara.com containing redirect, return_url, next, or similar parameters pointing to non-Aqara domains.
Email or messaging artifacts containing links to gw-builder.aqara.com with encoded external URLs in query strings.
Browser referrer headers showing transitions from gw-builder.aqara.com to unrelated, newly registered domains.

Detection Strategies

Inspect web proxy and DNS logs for Aqara SSO URLs with redirect parameters resolving to external hosts, and alert on mismatches against an Aqara domain allowlist.
Apply email security rules that flag inbound messages containing Aqara SSO links with long or encoded query parameters.
Hunt for user sessions that authenticate to Aqara and immediately navigate to unfamiliar domains within the same browser session.

Monitoring Recommendations

Monitor authentication telemetry from Aqara accounts for unusual login locations or password reset activity following click events.
Track newly registered domains that visually impersonate aqara.com and add them to blocklists.
Correlate phishing report submissions from end users with proxy logs referencing the Aqara SSO host.

How to Mitigate CVE-2026-50089

Immediate Actions Required

Educate users that links to gw-builder.aqara.com may forward to untrusted destinations and to verify the final URL before entering credentials.
Block or warn on outbound traffic where the Aqara SSO host issues redirects to non-Aqara domains at the secure web gateway.
Enforce multi-factor authentication on Aqara accounts so harvested passwords alone do not yield account takeover.

Patch Information

No vendor patch identifier is listed in the NVD record at the time of publication. Refer to the RunZero security advisory for the latest vendor remediation status and apply fixes as Aqara releases updates to the SSO gateway.

Workarounds

Configure web filtering policies to strip or rewrite redirect parameters on requests to gw-builder.aqara.com.
Add gw-builder.aqara.com to URL inspection lists in email security gateways so embedded redirect targets are evaluated against threat intelligence.
Advise administrators of Aqara deployments to bookmark direct login URLs and avoid following SSO links delivered through unsolicited messages.

bash

# Example web proxy rule (pseudocode) to flag suspicious Aqara SSO redirects
if host == "gw-builder.aqara.com" and query contains "redirect=" or "return_url=":
    extract target_url from query
    if domain(target_url) not in ["aqara.com", "*.aqara.com"]:
        action: block
        alert: "Potential CVE-2026-50089 open redirect abuse"