CVE-2026-50083 is a critical security vulnerability in the Aqara IAM/SSO Gateway caused by the presence of a hardcoded OAuth client credential (CWE-798). This weakness allows an attacker to bypass authentication and potentially compromise the confidentiality and integrity of the system. The vulnerability has a CVSS v3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. Although no direct exploit in the wild is reported, this vulnerability can be combined with related issues (CVE-2026-50082, CVE-50084, CVE-50085) to achieve a full unauthenticated remote takeover of affected devices. Currently, there is no official patch or remediation guidance from the vendor.

An attacker can exploit the hardcoded OAuth client credential to compromise the confidentiality and integrity of the Aqara IAM/SSO Gateway without requiring authentication or user interaction. This can lead to unauthorized access and control over the device, especially when combined with related vulnerabilities. The critical CVSS score reflects the high potential impact on affected systems.

No official patch or remediation guidance is currently available for this vulnerability. Users and administrators should monitor the vendor's advisories for updates. Until a fix is released, consider limiting network exposure of the affected device and applying compensating controls where possible.