Multiple critical vulnerabilities discovered in YoSmart YoLink Smart Hub ecosystem allowing remote control of other users' smart home devices, session hijacking, and data interception. Four CVEs affect different components: CVE-2025-59449 enables cross-account attacks due to insufficient authorization controls, CVE-2025-59452 uses predictable endpoint URLs derived from MAC addresses, CVE-2025-59448 transmits sensitive data over unencrypted MQTT, and CVE-2025-59451 involves session tokens with excessively long lifetimes. The vulnerabilities could allow attackers to gain full control over any YoLink user's devices worldwide. YoSmart has released patches and automatic updates to address these issues.