{"id":"CVE-2026-86553","published":"2026-09-20T04:17:06.240","lastModified":"2026-09-21T19:17:14.327","description":"SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840100","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}