Aqara Developer Portal cross-origin resource sharing

Executive summary #

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

Technical details #

Two adjacent CORS misconfigurations:

• developer.aqara.com/open-server/*: Origin: null and Origin: https://*.github.io both reflect into Access-Control-Allow-Origin: *. Sandboxed iframes (<iframe sandbox="allow-scripts">) issue null-origin requests by default, so exploitation is trivial from any web page.
• developer-test.aqara.com and aiot-test.aqara.com: Access-Control-Allow-Origin: * on actual GET/POST responses for any origin. Note, these test environments share the production user database, since the same account-existence oracle (code:10023 vs code:10024) returns identical results.

Further technical details for this issue can be found at https://github.com/xn0tsa/theres-no-place-like-home

Attacker value #

Combined with CVE-2026-50082, any web page can register a developer account in the victim's name (the provided auth code goes to whatever email the attacker chose) and enumerate developer accounts via the victim's IP.

Credit #

These issues were discovered, documented, and disclosed by Sammy Azdoufal. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-03-13: Set of issues discovered by the researcher and outreach to the vendor initiated

2026-03-30: Second outreach by the researcher

2026-04-08: Various findings and vulnerabilities remediated by the vendor

2026-04-20: Acknowledged the researcher's reporting

2026-04-20: The vendor stated this issue has been fixed

2026-06-11: This public disclosure (90 days from first contact)

For more details on specific findings and fixes, please see the researcher's website at https://github.com/xn0tsa/theres-no-place-like-home.