CVE-2026-109394CWE-639

CVE-2026-109394

High · published October 12, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-12T20:17Z
References (6)
https://github.com/thirtybees/thirtybees · [email protected]https://github.com/thirtybees/thirtybees/blob/1.7.0/controllers/front/PasswordController.php#L182-L200 · [email protected]https://github.com/thirtybees/thirtybees/commit/66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1 · [email protected]https://hackmd.io/@leediay/SJc93G5ofl · [email protected]https://www.vulncheck.com/advisories/thirty-bees-through-1.7.0-account-takeover-via-passwordcontroller-guest-checkout · [email protected]https://hackmd.io/@leediay/SJc93G5ofl · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 15:16Z
    Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout
    cvelistv5
  • 12 OCT 15:16Z
    Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout
    cvelistv5