Aqara Cloud’s OAuth authorization endpoint allows an attacker to bypass normal redirect_uri validation by providing a crafted redirect URL that matches loosely on the domain. Because the server validates the domain equivalence improperly, the redirect can be directed to a malicious host, enabling the attacker to retrieve the OAuth authorization code or access token after the user authorizes the request. This flaw is an instance of CWE-1289: Improper Validation of Unsafe Equivalence in Input, and the CVSS vector indicates a 9.3 score with high confidentiality and integrity impact, but no availability loss.

The vulnerability resides in Aqara’s Cloud OAuth Authorization Endpoint accessible at open-cn.aqara.com/oauth/authorize. Current information does not list specific patch versions, implying that all currently deployed instances of the endpoint without a vendor patch are potentially vulnerable.

The high CVSS score of 9.3 reflects the severity, and the EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in CISA’s KEV catalog, but the attack vector is public and requires user interaction to complete the OAuth flow. An attacker needing only to entice a user to visit a malicious link can hijack OAuth credentials, potentially granting access to the user’s Aqara account and associated IoT devices.