Medium severity4.3NVD Advisory· Published Sep 20, 2026· Updated Sep 22, 2026
CVE-2026-86554
CVE-2026-86554
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
3- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026
- ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More ThreatsThe Hacker News · Sep 28, 2026
- ZTE SmartLife Flaws Let Attackers Hijack Accounts by Resetting Passwords Without VerificationCyber Security News · Sep 22, 2026