CVE-2026-86553

Name of the Vulnerable Software and Affected Versions SmartLife app (affected versions not specified)

Description An authentication bypass exists due to the way the application dynamically generates authentication parameters within its runtime process. An attacker can acquire these parameters to interact directly with backend services, bypassing standard security checks. By calling the '/account/verify.serv' endpoint with a registered email address, an attacker can retrieve the corresponding real account ID. Subsequently, by spoofing the authentication information and using the acquired account ID, an attacker can reset the password of any registered account, leading to full account compromise and potential control over connected smart devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.