As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter).
The attack is remote but the effect is local to an affected property.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| akia | akia | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://www.akia.com/platform/keyless-entry |
|
Fri, 25 Sep 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property. | |
| Title | Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms | |
| Weaknesses | CWE-639 CWE-862 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CIRCL
Published:
Updated: 2026-09-25T10:07:35.224Z
Reserved: 2026-09-25T10:07:22.362Z
Link: CVE-2026-97898
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-25T10:17:08.907
Modified: 2026-09-25T10:17:08.907
Link: CVE-2026-97898
Redhat
No data.
OpenCVE Enrichment
No data.