TTLock, the Bluetooth lock platform from the Chinese company Sciener, has a new high-severity vulnerability on record. CVE-2026-112345 was published on 26 October 2026, with VulnCheck as the assigning authority and the researcher Yassine Damiri credited with the find. It covers the TTLock Android app before version 9.8.260718 and the lock firmware that works with it. TTLock is not one brand on a shelf. Its app and firmware sit inside many cheap fingerprint and keypad locks sold under other names, which is why the record matters well beyond a single product.

What is wrong

When a phone pairs with a TTLock lock, the lock sends back a session key (aesKeyStr) that the app then uses for every later command. That exchange is encrypted with a static AES key called defaultKey, and that key is the same in the app and in the firmware of every lock. Damiri's write-up, dated 23 October, says the key can be pulled out of the app or the firmware by reverse engineering.

The attack, as described in the CVE record and the researcher's notes:

  1. Someone within Bluetooth range passively records the two frames of the pairing exchange.
  2. They decrypt the lock's reply with defaultKey and get the session key in plain text.
  3. With that key they can send commands the lock accepts as genuine: unlock, add a fingerprint, add an access code, change settings.

No login and no action from the owner are needed. The session key is not rotated for as long as the pairing lasts, so one recorded pairing gives lasting control rather than a single opening. VulnCheck rates it 8.6 on CVSS 4.0 (8.1 on CVSS 3.1) and lists the attack vector as adjacent, meaning radio range.

The limits

The attacker has to be nearby at the moment of pairing. Locks that were paired long ago in a private place are less exposed than ones paired in a shop, a rental flat or a hallway, or ones that get reset and paired again. The SSVC data in the record marks exploitation as "poc" (a proof of concept exists), and the flaw is not in CISA's catalogue of exploited vulnerabilities.

The record lists app versions before 9.8.260718 as affected. It does not name fixed firmware versions or specific lock models, and it gives no vendor advisory or workaround.

What owners can do

  • Update the TTLock app (or the white-label app that ships with the lock) and check for a lock firmware update.
  • If a lock was paired where strangers could have been within range, reset it and pair it again at home, after updating.
  • Review the fingerprints and codes stored in the lock and delete any you did not add.
  • For a door that really matters, do not rely on the Bluetooth lock alone.