Authentication Bypass in SmartLife App by ZTE

CVE-2026-86554

What is CVE-2026-86554?

The SmartLife app contains a vulnerability that allows attackers to generate application authentication parameters during runtime, potentially leading to account information disclosure. By exploiting this flaw, an attacker can invoke the backend interface to verify if a specific email address is linked to a SmartLife account. If the account exists, they can retrieve sensitive information such as the backend account ID, posing a risk of unauthorized access and potential data breaches.

References