This report details four vulnerabilities (CVE-2026-86552 to CVE-2026-86555) discovered in ZTE SmartLife. The most critical flaw, CVE-2026-86553, involved a password reset vulnerability in the SmartLife account backend. The reset endpoint allowed setting a new password for any account by providing only the target accountId and the new password. Crucially, it lacked validation for a reset code, the old password, or confirmation of a legitimate reset transaction. Another vulnerability involved an endpoint that would reveal if an email was registered and, if so, return the associated backend account ID. This allowed an attacker to enumerate valid user accounts. By chaining these two vulnerabilities, an attacker could: first, identify a target email, then obtain its corresponding accountId, and finally, initiate a password reset to an attacker-chosen new password. The researcher confirmed the success of this attack by verifying that the old password no longer worked and the newly set password successfully granted access to the account. Additional research encompassed the authentication mechanism employed by the Android client and the email ownership verification process during registration. The broader attack surface of the SmartLife/Homecare SDK, accessible post-login, was also investigated. ZTE has since patched these reported issues and assigned the respective CVEs.