CVE-2026-86552: A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to acquire SmartLife application authentication credentials generated by the app at runtime. They can then call the backend /account/person/signup.serv interface to register using an arbitrary email address.
Is user interaction or access to the target email account required?
No. The described registration flow does not verify ownership of the email address before creating the account, so the attacker does not need access to that mailbox.
Who is affected by fraudulent registrations?
People whose email addresses are used by an attacker to register SmartLife accounts without their authorization. The available information does not state whether existing accounts can be taken over or whether any email notification is sent.