Vulnerability · Published Sep 20, 2026 · Assigned by zte
CVE-2026-86554Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP
Medium 4.3
In plain English
A medium-severity privilege mismanagement in SmartLife from ZTE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N