CVE-2026-109394: Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this account-takeover issue?
Thirty bees installations through version 1.7.0 are exposed when guest checkout is enabled. The attack targets registered customer accounts whose email address an attacker can use when placing a guest order.
What does an attacker need to exploit the vulnerability?
The attacker does not need to authenticate or interact with the victim. They need to place a guest order using the victim's email address and obtain the resulting guest account secure key, which can then be used to reset the registered customer's password.
What can be done if an update cannot be applied immediately?
Disable guest checkout to remove the condition required for the described attack. Monitor for guest orders placed with email addresses belonging to existing registered customers and for unexpected password resets.