CVE-2026-97898: Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property.
As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter).
The attack is remote but the effect is local to an affected property.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated guest at an affected property could exploit it. The attack is remote, but the resulting unauthorized access is limited to guest rooms at that property.
What does exploitation require?
The attacker needs a valid authenticated guest session and a client-supplied room or door identifier for another room. The service did not properly verify that the requested room was associated with the guest's booking.
Is the service still vulnerable?
No. Feedback received by the reporter indicates that, as of 19 September 2026, the service was no longer vulnerable to this attack.