ZTE SmartLife App Vulnerabilities Enable Account Takeovers via Password Reset Flaws
Four critical vulnerabilities in ZTE's SmartLife app, including a severe password reset flaw (CVE-2026-86553), allowed attackers to hijack user accounts.
ZTE has released patches for four significant vulnerabilities discovered in its SmartLife mobile application, which collectively enabled attackers to compromise user accounts. The most critical of these, CVE-2026-86553, carried a CVSS score of 8.8 and allowed for account takeovers by enabling attackers to reset user passwords without proper verification.
This severe flaw in the password reset mechanism meant that an attacker could initiate a password change for a target account simply by providing the account ID and a new password. Crucially, the process bypassed standard security protocols, such as sending a verification code to the legitimate account owner or requiring any form of multi-factor authentication before accepting the new credentials. The backend system failed to implement essential server-side verification, accepting the reset request based solely on the account identifier and the proposed new password.
Compounding the password reset vulnerability was CVE-2026-86554, an account enumeration flaw. This vulnerability allowed attackers to query the /account/verify.serv backend interface to determine if a specific email address was registered within the SmartLife system. If a valid email was found, the API would also disclose the associated backend account ID, providing attackers with the necessary information to exploit the password reset vulnerability more effectively.
Security researcher Mina Nageh Salama uncovered these issues while investigating ZTE's SmartLife ecosystem and related router firmware. The research identified a total of four CVEs, all of which ZTE has since addressed. Beyond the critical password reset and enumeration flaws, CVE-2026-86552 involved an email verification bypass that could facilitate fake account registration, and CVE-2026-86555 exposed a hardcoded mobile app key, potentially allowing decryption of sensitive account-server information.
The implications of these vulnerabilities are substantial, particularly concerning the reliance on application-level authentication for critical account management functions. While such authentication can confirm the request originates from an authorized application, it should not replace robust, account-specific verification for sensitive operations like password resets. A compromised SmartLife account could grant attackers access to a user's home and device configurations managed through the app, leading to broader security breaches.
ZTE confirmed that all reported vulnerabilities were patched and issued advisories on September 20, 2026. Users of the SmartLife application are strongly advised to update to the latest version available through official app stores. Additionally, changing passwords, especially if they are reused across other services, and reviewing connected devices and shared home members are recommended security measures.
This incident serves as a critical reminder for vendors about the necessity of implementing robust server-side verification for all password reset processes. Relying solely on client-side or application-level checks can create significant security gaps, leaving user accounts vulnerable to takeover. The SmartLife app's vulnerabilities highlight a common pitfall in application security where convenience is prioritized over fundamental security controls.
The coordinated disclosure process ensured that ZTE could address these critical flaws before they could be widely exploited. However, the existence of these vulnerabilities underscores the ongoing need for diligent security research and prompt patching by device manufacturers to protect consumers' connected home environments.