CVE-2026-109394 Details
Description
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.
An authentication bypass vulnerability has been identified in Thirty Bees e-commerce platform, specifically in version 1.7.0. The issue resides in the PasswordController's resolveCustomer() method, where guest account tokens are improperly validated. This flaw enables unauthenticated attackers to reset passwords of registered customers by exploiting guest checkout features. By placing a guest order using the victim's email, attackers can obtain a secure key that allows them to reset the victim's password and gain unauthorized access to their account.
The vulnerability has been fixed in the latest commit on the main branch. Users should update to the latest version of Thirty Bees.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@leediay/SJc93G5ofl | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/thirtybees/thirtybees | [email protected] | ProductSource CodeVendor |
| https://github.com/thirtybees/thirtybees/blob/1.7.0/controllers/front/PasswordController.php#L182-L200 | [email protected] | Source CodeVendor |
| https://github.com/thirtybees/thirtybees/commit/66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1 | [email protected] | Source CodeVendor |
| https://hackmd.io/@leediay/SJc93G5ofl | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/thirty-bees-through-1.7.0-account-takeover-via-passwordcontroller-guest-checkout | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| thirty bees | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |