The Aqara IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect vulnerability classified as CWE-601. This vulnerability allows attackers to craft URLs that redirect users to untrusted external sites, potentially enabling phishing attacks. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with a scope change. The affected version explicitly identified is the 2026-04-20 release. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to phishing attacks where users are redirected to malicious sites, potentially resulting in disclosure of sensitive information or credential theft. The impact affects confidentiality and integrity but does not affect availability. The vulnerability requires user interaction to be exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious of suspicious links involving the Aqara IAM/SSO Gateway and consider implementing external mitigations such as URL filtering or user awareness training to reduce phishing risks.