Cyber Resilience

CVE-2026-50083

Critical

Published: 12 June 2026

Published
12 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0025 15.8th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-50083 is a critical-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Runzero (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 15.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A07:2025 Authentication Failures

EU & UK References

Vulnerability details

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can…

more

lead to a fully unauthenticated, remote takeover of affected devices.

CWE(s)
CWE-798

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Hardcoded OAuth client credential (CWE-798) directly exposes a default valid credential usable for authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

Runzero
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification
addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

AT-3 Role-based Training
addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

IA-1 Policy and Procedures
addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

IA-13 Identity Providers and Authorization Servers
addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

IA-5 Authenticator Management
addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

PL-9 Central Management
addresses: CWE-798

Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.

PM-16 Threat Awareness Program
addresses: CWE-798

Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.

PM-3 Information Security and Privacy Resources
addresses: CWE-798

Planned investment enables secure credential storage and management systems instead of hard-coded credentials.

References