CVE-2026-86554
Received Received - Intake

SmartLife App Authentication Parameter Generation Vulnerability

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: ZTE Corporation

Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-86554
EUVD
EUVD-2026-83712

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
zte smartlife *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the SmartLife app allows attackers to generate authentication parameters during runtime. These parameters can then be used to check if a specific email is registered with a SmartLife account by calling a backend interface. If the account exists, the attacker can also retrieve the account ID.

Impact Analysis

Attackers could use this flaw to verify if your email is linked to a SmartLife account and obtain your account ID. This may lead to privacy breaches or targeted phishing attempts using your registered email.

Mitigation Strategies

Implement strict input validation for email address queries to prevent enumeration. Restrict access to the /account/verify.serv backend interface to authorized sources only. Monitor network traffic for unusual requests targeting this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart