CVE-2026-97898 Details
Description
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no more vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.
A vulnerability allowing unauthorized physical access to guest rooms has been identified in the Akia keyless entry cloud service. This issue arises from insecure direct object references and a lack of proper authorization for room or door identifiers supplied by clients. As a result, an authenticated guest could unlock rooms that are not assigned to them, leading to unauthorized access. This vulnerability was present prior to September 19, 2026, and affects properties using the Akia keyless entry service.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.akia.com/platform/keyless-entry | CIRCL | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | CIRCL |
| CWE-862 | Missing Authorization | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| Akia | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | CIRCL |