Aqara’s Cloud Production API mistakenly authorizes any valid developer token to access any user account. This missing authorization flaw (CWE‑862) allows an attacker with a legitimate token to read sensitive account data and, when combined with other API weaknesses, to remotely take control of Aqara devices.

The vulnerability resides in Aqara’s Cloud Production API endpoint at open-cn.aqara.com/v3.0/open/api. No specific software versions are listed; the issue applies to the current production API service.

The CVSS score of 9.6 marks this flaw as Critical. Although the EPSS score is not available, the lack of a KEV listing does not reduce the severity of the identified risks. The likely attack vector is an authenticated network request to the API; the attacker must possess a legitimate developer token, which could be obtained through credential compromise or token theft. If the token is in hand, the attacker can exploit the missing boundary checks to pivot into other accounts and ultimately gain unauthenticated remote control of devices.