CVE-2026-86552

MediumCVSS 5.4

Published: 20/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 20/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

19th percentile - higher than 19% of all known CVEs

Summary

The SmartLife app dynamically generates new authentication parameters at runtime. Using them, an attacker can directly register an account with any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified before registration.

Risk Assessment

An attacker can create fake accounts, potentially leading to abuse and system integrity issues.

Recommendation

Contact the SmartLife vendor for patches and consider strengthening the registration process.

Other vulnerabilities in SmartLife app

CVE-2026-86553High
The SmartLife app dynamically generates authentication parameters at runtime. Using these parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID for a registered email address. By spoofing the app authentication info with the target account ID, the attacker can reset the target account's password.

Original NVD description (English source)

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS