Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.
CVE-2026-97898
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97898
akia
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "akia",
"product": "akia",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.10.19",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-97898
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #2021 · Revision 1
- Added to Heist Feed
- Publisher date