CVE-2026-97898
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry…
- Risk score
- 58/100
- CVSS
- 8.4 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other th…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
- Remotely exploitable without logging in
References
Original description
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.
Last activity 25 Sep 2026. Patch Forecast updates every hour.