CVE-2026-50090 | Aqara | Valters IT Hub

CVE-2026-50090 is a critical vulnerability (CVSS 9.3) in the Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize).

If you're connecting your Aqara devices directly to Home Assistant and are not using the Aqara cloud, then my read on this is that you should be good to go. This is not a vulnerability in the devices themselves but with the Aqara cloud stuff.