Authentication Bypass in Thirty bees Password Reset

Executive Summary

CVE-2026-109394 is an authentication bypass vulnerability in the thirty bees e-commerce platform up to version 1.7.0. It allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers exploit this by placing a guest order with the victim's email, then using the guest secure key to reset and take over the victim's account when guest checkout is enabled.

Useful 0 Not Useful 0

Detection Guidance

Check if your thirty bees installation is version 1.7.0 or earlier. Inspect PasswordController.php for the vulnerable resolveCustomer() function logic. Look for duplicate guest customer entries with the same email as registered accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full control of a victim's account by resetting their password. Once compromised, attackers can access personal data, order history, and payment details. Exploitation requires only the victim's email and the ability to place a guest order with guest checkout enabled.

Useful 0 Not Useful 0

Mitigation Strategies

Update thirty bees to the latest patched version immediately. Disable guest checkout if not required. Review all guest orders for suspicious activity and reset passwords for affected accounts.

Useful 0 Not Useful 0