CVE WatchJul 9, 2026

CVE-2026-50083

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-cod

CVSS

9.1

Critical

EPSS

0.4%

p30

KEV

—

Exploit Today

0-100

Published: Jun 12, 2026 · Last modified: Jul 9, 2026 · CWE-798

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-08-202026-09-17

Technical description

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-814407.3 HIG

—

——0Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.1d CVE-2026-927879.8 CRI

31.2%

——9Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.2d CVE-2026-689508.8 HIG

13.2%

——4The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.2d CVE-2026-668909.6 CRI

9.7%

——3The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.2d CVE-2026-371529.8 CRI

40.2%

——12TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.2d CVE-2026-161418.1 HIG

32.9%

——10OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.3d