CVE-2026-50091

HighCVSS 7.4/10Last modified Oct 26, 2026

Description

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

Vendor	Product	Versions
Aqara	com.lumiunited.aqarahome	>= 6.0.0, < 0

References

https://github.com/xn0tsa/theres-no-place-like-homeExploit, Third Party Advisory
https://www.runzero.com/advisories/aqara-hardcoded-sdk-keys-cve-2026-50091Exploit, Third Party Advisory
https://github.com/xn0tsa/theres-no-place-like-homeExploit, Third Party Advisory

Timeline

Published: Jun 12, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-500939.0A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All version CVE-2026-500956.1There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some configurations allows CVE-2026-500966.1There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthen CVE-2026-500994.6During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UAR CVE-2026-50105.1A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaS CVE-2026-501008.5Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If thi CVE-2026-501018.1Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this CVE-2026-501036.5A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing app CVE-2026-501054.3RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-501066.5When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for CVE-2026-501078.1When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGIN CVE-2026-501087.5The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester