CVE-2026-50086 describes a critical vulnerability in the Aqara IAM/SSO Gateway where bidirectional AES round-trups against the platform's signing key are exposed without requiring authentication. This constitutes both a missing authentication for a critical function (CWE-306) and the use of a broken or risky cryptographic algorithm (CWE-327). The vulnerability allows an attacker to interact with cryptographic operations that should be protected, potentially compromising confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with scope changed and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability to perform cryptographic operations against the platform's signing key, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The critical CVSS score of 10 reflects the severity and ease of exploitation over the network without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or vendor advisory is provided at this time. Until a patch is available, restrict network access to the Aqara IAM/SSO Gateway to trusted entities only and monitor for suspicious activity related to cryptographic operations.