SmartLife App Auth Param Leak Enables Account Enumeration
CVE-2026-86554 Published on September 20, 2026

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
SmartLife app dynamically generates brandnew SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

NVD

Vulnerability Analysis

CVE-2026-86554 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Improper Privilege Management

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.


Affected Versions

ZTE SmartLife Version ZTE_SL_V2.8.2_ABROAD and prior versions is affected by CVE-2026-86554