CVE-2026-86554
Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
- State
- Published
- Severity
- 4.3 Medium
- Published
- Sep 20, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 8, 2026
Description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | zte |
Weaknesses
- CWE-269 # CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
SmartLifeZTE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.