Aqara IAM/SSO Gateway open redirect

Executive summary #

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1 Medium), which can be used to set up a phishing attack.

Technical details #

GET /iam/ucauth/skipToUcAuthUrl?callBackUrl=<URL> issues an HTTP 302 to the attacker-controlled URL after the user authenticates, carrying SSO parameters in the redirected URL. No allowlist on the callBackUrl parameter.

Repro:

curl -i 'https://gw-builder.aqara.com/iam/ucauth/skipToUcAuthUrl?callBackUrl=https://evil.example.com'
# → HTTP 302, Location: https://uc.aqara.com/creator-hub/signin?appId=68&service=https://evil.example.com

Further technical details for this issue can be found at https://github.com/xn0tsa/theres-no-place-like-home

Attacker value #

This vulnerability creates a convincing phishing surface, and additionally, can leak an SSO ticket or auth code leak to an attacker-controlled domain after user consent.

Credit #

These issues were discovered, documented, and disclosed by Sammy Azdoufal. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-03-13: Set of issues discovered by the researcher and outreach to the vendor initiated

2026-03-30: Second outreach by the researcher

2026-04-08: Various findings and vulnerabilities remediated by the vendor

2026-04-20: Acknowledged the researcher's reporting

2026-04-20: The vendor stated this issue has been fixed

2026-06-12: This public disclosure (90 days from first contact)

For more details on specific findings and fixes, please see the researcher's website at https://github.com/xn0tsa/theres-no-place-like-home.