CVE-2025-56400 is a CSRF vulnerability in the OAuth flow of the Tuya SDK 6.5.0 used in Tuya Smart, Smartlife, and other third-party apps. The OAuth implementation fails to validate the state parameter during the account linking process, enabling attackers to perform a CSRF-like attack. By convincing a victim to click a malicious authorization link, an attacker can complete the OAuth linking flow on behalf of the victim, associating the attacker’s Amazon Alexa account with the victim’s Tuya account. This grants unauthorized Alexa access to the victim’s smart devices controlled via Tuya, potentially allowing remote control of sensitive devices such as cameras, doorbells, door locks, and alarms. The vulnerability is exploitable without the Tuya app running and regardless of whether the victim previously linked Alexa to their Tuya account. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to link their own Amazon Alexa account to a victim’s Tuya account without the victim’s consent. This unauthorized linkage can lead to remote control of smart home devices connected through Tuya, including cameras, doorbells, door locks, and alarms. The compromise affects user confidentiality, integrity, and availability of their smart home environment. The attack requires user interaction (clicking a crafted link) but no prior Alexa linkage or active Tuya app is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious about clicking unsolicited authorization links related to Tuya or Alexa integrations. Developers integrating the Tuya SDK should verify OAuth state parameter validation is correctly implemented to prevent CSRF attacks. Monitor vendor communications for updates and apply official patches once released.