CVE-2026-86552 PUBLISHED

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

Assigner: zte
Reserved: 08.09.2026 Published: 20.09.2026 Updated: 20.09.2026

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	ZTE
Product	ZTESW
Versions	Default: unaffected Version ZTE_SL_V2.8.2_ABROAD and prior versions is affected

Credits

Mina Nageh Salama Zekry finder

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/460174866982102946

Problem Types

# CWE-269 Improper Privilege Management CWE

Impacts

CAPEC-115 Authentication Bypass