The Aqara Cloud Developer Portal (developer.aqara.com) suffers from a CWE-306 vulnerability where it issues developer tokens without authenticating the requesting email address. This missing authentication for a critical function allows any attacker to obtain a developer token by supplying an arbitrary email address. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity. While this vulnerability alone causes limited impact, it can be chained with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085 to enable a full takeover of affected devices. The affected version is exactly the 2026-04-20 release of the portal. There is no vendor advisory or patch information available at this time.

An attacker can obtain a developer token without authentication by supplying any email address, leading to limited confidentiality and integrity impacts on the Aqara Cloud Developer Portal. This vulnerability alone does not allow full device compromise but can be combined with other vulnerabilities to achieve full takeover of affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.