Medium severity5.4NVD Advisory· Published Sep 20, 2026· Updated Sep 22, 2026
CVE-2026-86552
CVE-2026-86552
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
3- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More ThreatsThe Hacker News · Sep 28, 2026
- ZTE SmartLife Flaws Let Attackers Hijack Accounts by Resetting Passwords Without VerificationCyber Security News · Sep 22, 2026