https://reddit.com/r/netsec/comments/1wmhror/zte_smarthome_account_takeover_password_reset/: ZTE SmartHome Account Takeover: Password Reset Without Verification Code. 4 CVEs, 100K+ Android Downloads - CVE-2026-86553
Affected Software
Frequently Asked Questions
What information would an attacker need to take over an account?
The reported chain required only the victim's registered email address. An endpoint could reveal whether that email was registered and return its backend account ID, which was then accepted by the password-reset endpoint along with an attacker-chosen password.
Did exploitation require access to the victim's current password, email inbox, or a reset code?
No. The affected reset endpoint reportedly accepted an account ID and a new password without requiring the existing password, a reset code, or a validated reset transaction.
How was account takeover confirmed?
The researcher verified that the previous password no longer worked and that the attacker-selected password could obtain a valid session. This demonstrates a password change and successful login for researcher-controlled accounts.
Are fixes available?
ZTE patched the reported issues. The report identifies CVE-2026-86552, CVE-2026-86553, CVE-2026-86554, and CVE-2026-86555 as the assigned CVEs.