CVE-2026-86553
Received Received - Intake

SmartLife App Authentication Parameter Spoofing Leads to Account Takeover

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: ZTE Corporation

Description
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-86553
EUVD
EUVD-2026-83649

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the SmartLife app allows attackers to generate authentication parameters during runtime. By exploiting this, they can call a backend interface to retrieve the real account ID linked to a registered email address. This enables attackers to spoof authentication and reset the target account's password.

Impact Analysis

If you use the SmartLife app, an attacker could gain unauthorized access to your account by resetting your password. This could lead to data theft, unauthorized actions, or loss of control over your account and associated data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using SmartLife may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update the SmartLife app to the latest version if an update is available. Disable or restrict access to the backend interface /account/verify.serv if possible. Monitor network traffic for unusual requests to this interface. Implement strong authentication mechanisms and rate limiting to prevent brute force attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart