CVE-2026-50089 Aqara IAM/SSO Gateway open redirect

Medium 6.1 Published 12 Jun 2026 Updated 12 Jun 2026

An open redirect in the Aqara IAM/SSO Gateway allows attackers to redirect users to malicious sites, facilitating phishing attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-50089?

CVE-2026-50089 is a medium-severity vulnerability in Aqara IAM/SSO Gateway, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 Medium), which can be used to set up a phishing attack.

Weakness: CWE-601

Which versions are affected by CVE-2026-50089?

It affects 1 product.

Products include Aqara Iam\/Sso Gateway.

How do I fix CVE-2026-50089?

No fix has been published for CVE-2026-50089 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-50089 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50089 exists.

Sources

Also known as GHSA-x2pr-g8vf-qfcp.