{"id":"CVE-2026-86553","aliases":["EUVD-2026-83649","GHSA-9f8w-25xq-gfm7"],"status":"published","title":"A password reset vulnerability in ZTE SmartLife APP","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00524,"percentile":0.44899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-09-20T03:17:20Z","modified":"2026-09-22T19:41:38Z","products":[{"vendor":"zte","product":"smartlife"}],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840100"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86553"},{"url":"https://github.com/advisories/GHSA-9f8w-25xq-gfm7"}],"sources":{"cve":[{"id":"CVE-2026-86553","title":"A password reset vulnerability in ZTE SmartLife APP","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","status":"published","published":"2026-09-20T03:17:20.888Z","modified":"2026-09-21T18:10:25.088Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T13:49:31.546614Z"}],"euvd":[{"id":"EUVD-2026-83649","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","status":"published","published":"2026-09-20T03:17:20Z","modified":"2026-09-21T18:10:25Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:05.032636Z"}],"ghsa":[{"id":"GHSA-9f8w-25xq-gfm7","title":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside...","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","status":"published","published":"2026-09-20T06:30:19Z","modified":"2026-09-20T06:30:20Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:12:14.055197Z"}],"nvd":[{"id":"CVE-2026-86553","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","status":"published","published":"2026-09-20T04:17:06.24Z","modified":"2026-09-22T19:41:38.447Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:50.043898Z"}]}}