CVE-2026-50086 describes a critical vulnerability in the Aqara IAM/SSO Gateway where bidirectional AES round-trups are exposed against the platform's signing key without any authentication. This represents a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. No patch or official remediation level has been provided by the vendor, and no known exploits are reported in the wild.

The vulnerability allows unauthenticated remote attackers to exploit weak cryptographic operations involving the platform's signing key, potentially compromising the confidentiality, integrity, and availability of the Aqara IAM/SSO Gateway. This could lead to unauthorized access or manipulation of authentication mechanisms and sensitive data within the gateway environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the Aqara IAM/SSO Gateway to trusted entities only and monitor for unusual activity related to cryptographic operations. Avoid exposing the gateway to untrusted networks.