CVE-2025-15115CWE-862broken-access-control

CVE-2025-15115

Medium · published January 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploiting OAuth token validation flaws in the social login system. Attackers can send requests to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-04T05:15Z
Affected products (1)
ProductVersionsFixed in
petlibro/petlibro≤ 1.7.31—
References (2)
https://bobdahacker.com/blog/petlibro · [email protected]https://www.vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-authentication-bypass-via-api-endpoint · [email protected]
EPSS history
Timeline
  • 03 JAN 23:33Z
    Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint
    cvelistv5