CVE-2026-86553
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The SmartLife app dynamically generates authentication parameters at runtime. Using these parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID for a registered email address. By spoofing the app authentication info with the target account ID, the attacker can reset the target account's password.
Risk Assessment
An attacker can take over user accounts, leading to privacy breaches and potential further attacks.
Recommendation
Contact the SmartLife vendor for patches immediately and consider temporarily disabling password reset functionality.
Other vulnerabilities in SmartLife app
Original NVD description (English source)
SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS