CVE-2026-86553

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

• CWE-269

• https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/2171542593031840100

Published

Sep 20, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86544knowns versions before 0.30.0 contain an authorization bypas…8.1
• CVE-2026-86547mrubyc through 4.0.0 contains a null pointer dereference vul…6.2
• CVE-2026-8655Multiple Memory overflow vulnerabilities in NetScaler ADC an…9.8
• CVE-2026-86550NuBrowser lacks protocol whitelist validation for the S.brow…6.5
• CVE-2026-86551The Z80Ultra (NX741J) product contains a vulnerability where…3.3
• CVE-2026-86552SmartLife app dynamically generates brand‑new SmartLife appl…5.4
• CVE-2026-86554SmartLife app dynamically generates brand‑new SmartLife appl…4.3
• CVE-2026-86555The ZTE SmartLife application has a hardcoded key. The key u…6.2
• CVE-2026-86556There is an information disclosure vulnerability in ZTE U30 …5.3
• CVE-2026-8656Versions of the package jsondiffpatch before 0.7.6 are vulne…6.1
• CVE-2026-86561A flaw was found in DPDK lib/vhost. Memory size is not adequ…6.5
• CVE-2026-86562A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of…7.8