The vulnerability is an insecure direct object reference that allows an authenticated guest to specify any room or door identifier in the unlock request without the server validating that the requested object belongs to the guest’s reservation. Because the unlock operation is performed server‑side, the attacker can effectively unlock any door within the property that is not their own, giving them unauthorized physical access to other guest rooms. This directly undermines the premises security model and can result in theft, privacy violations, or other in‑person harm.

The affected product is Akia Keyless Entry cloud service. No specific affected versions are published, but any deployment running the service prior to the update released after 19 September 2026 remains vulnerable. Users of Akia’s platform who provide a client‑side API or web portal that sends room identifiers to the unlock endpoint are at risk.

The CVSS score of 8.4 indicates a high severity, and the EPSS score is not available, so the probability of exploitation cannot be precisely measured. The attack vector is remote—an attacker authenticates to the portal or API and sends a crafted request, but the impact is local to the property since only the unlocked door is affected. The vulnerability is not listed in the CISA KEV catalog, which suggests no large‑scale exploitation is known at this time.