CVE-2026-86554
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.
- Published Sep 20, 2026
- CVSS 4.3 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)