---
id: "CVE-2026-97858"
kind: "vulnerability"
aliases: ["CVE-2026-97858"]
title: "Device binding flaw lets attacker take over another account's device"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["device-binding", "iot", "other"]
not_affected_if: []
published_at: "2026-10-16T14:19:36+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:42:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97858", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Device binding flaw lets attacker take over another account's device

An attacker can make the server unbind a target device from its current owner and rebind it to the attacker's own account, even when the device belongs to someone else. The attacker then obtains the device's full serial ID.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97858

## From the sources

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_