
Aqara Cloud OAuth Flaw (CVE-2026-50090): What It Is and Whether You Are Affected
CVE-2026-50090 is a CVSS 9.3 OAuth redirect bypass in Aqara's cloud. If you run Zigbee2MQTT, ZHA, or local HomeKit, you are not in scope. Here is why.

CVE-2026-50090 is a CVSS 9.3 OAuth redirect bypass in Aqara's cloud. If you run Zigbee2MQTT, ZHA, or local HomeKit, you are not in scope. Here is why.

A 16 June Mijia outage broke the app for tens of millions. Here's why local Home Assistant automations kept running and what determines if yours would too.

Pair the Aqara QBKG21LM no-neutral switch to Home Assistant via Zigbee2MQTT or ZHA, skip the Aqara Hub, and plan mesh placement correctly.

ZHA or Zigbee2MQTT for Aqara Zigbee devices? A device-specific comparison of setup, attribute exposure, quirks vs converters, and switching cost.

What data does the official ha_xiaomi_home integration send to Xiaomi's cloud? Token storage risks, LAN mode limits, and who true local control works for.

Flash pvvx firmware on the Xiaomi Mijia Thermometer 3 (MJWSD05MMC) and add it to Home Assistant locally via BTHome — no Mi Home cloud, no ESP32 needed.

How to pair the Aqara P2 door sensor to Home Assistant via Matter over Thread: prerequisites, step-by-step pairing, entity setup, and troubleshooting.

Set up the Xiaomi Multimode Gateway (ZNDMWG03LM/ZNDMWG02LM) for true local control in Home Assistant using XiaomiGateway3 — no cloud required.

Set up the Aqara Wall Outlet H2 EU (WP-P01D) in Home Assistant via Zigbee2MQTT — no hub, no cloud. Full entity walkthrough and energy automations.

Set up the Aqara Rotary Knob H1 (ZNXNKG02LM) with Zigbee2MQTT and Home Assistant, no hub needed: pairing, event mode, rotation automations, blueprints.