CVE-2026-86553 | BDVDB-2026-377183 Detail

Description#

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-20Record published in the CVE List.
2. Version 22026-09-21Most recent update recorded in the CVE List.