Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-86552

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
zte

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ZTE SmartLife

Default version status: unaffected

  • ZTE_SL_V2.8.2_ABROAD and prior versionsaffected

References