CVE-2026-50087 is a vulnerability in the Aqara IAM/SSO Gateway (version 2026-04-20) characterized by a permissive cross-domain policy that allows untrusted domains to make cross-origin requests, classified as CWE-942. The vulnerability has a CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available, and the gateway is not a cloud service, so remediation depends on vendor action.

The vulnerability allows untrusted domains to bypass cross-origin restrictions, potentially leading to high confidentiality impact by exposing sensitive information. Integrity impact is low, and availability is not affected. The vulnerability requires user interaction but no privileges or complex attack conditions. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. As the product is not a cloud service, remediation depends on vendor patch releases or configuration changes to restrict cross-domain policies.