The Aqara IAM/SSO Gateway version 2026-04-20 suffers from a cross-origin request sharing vulnerability due to a permissive cross-domain policy that trusts untrusted domains (CWE-942). This misconfiguration allows potentially malicious domains to access sensitive data across origins, leading to a high confidentiality impact. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges, requires user interaction, and results in a partial loss of integrity and a complete loss of confidentiality. No known exploits are reported in the wild, and no vendor-provided patch or remediation is currently documented.

Successful exploitation can lead to unauthorized disclosure of sensitive information due to the overly permissive cross-domain policy. Confidentiality is highly impacted, while integrity is partially affected. Availability is not impacted. The vulnerability can be exploited remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should monitor vendor communications for updates. Avoid interacting with untrusted domains via the affected gateway until a fix is available.