Threats affecting pkg:github/xn0tsa/theres-no-place-like-home

CVE-2026-50089 is a medium severity vulnerability in the Aqara IAM/SSO Gateway that allows an open redirect to untrusted sites. This issue is classified as CWE-601 and can be exploited to facilitate phishing attacks by redirecting users to malicious URLs. The vulnerability requires no privileges and user interaction is needed to trigger the redirect. It impacts confidentiality and integrity but not availability.

CVE-2026-50085 is a high-severity vulnerability in the Aqara Board service that allows unauthenticated MQTT command payloads to be forwarded to the platform's HiveMQ broker. This missing authentication for a critical function (CWE-306) can lead to partial compromise of confidentiality, high impact on integrity, and low impact on availability. When combined with related vulnerabilities CVE-2026-50082, CVE-50083, and CVE-50084, it may enable a fully unauthenticated remote takeover of affected devices.

The Aqara IAM/SSO Gateway has a critical vulnerability due to the use of a hardcoded OAuth client credential (CWE-798). This flaw allows attackers to potentially compromise confidentiality and integrity without authentication or user interaction. The vulnerability has a CVSS score of 9.1 (critical). When combined with related vulnerabilities, it may enable a fully unauthenticated remote takeover of affected devices. No official patch or remediation guidance is currently available.