{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athirtybeesthirty_bees/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thirtybees:thirty_bees:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-109394"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Thirty bees (\u003c= 1.7.0)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","e-commerce","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Thirty bees"],"content_html":"\u003cp\u003eThirty bees through version 1.7.0 contains an authentication bypass vulnerability located in the PasswordController::resolveCustomer() method. This vulnerability stems from improper validation of guest account tokens, which allows an unauthenticated remote attacker to reset the passwords of registered customers. The attack requires the platform to have the guest checkout functionality enabled. By placing a guest order using a targeted victim's email address, an attacker can obtain a guest secure key. This key is then abused to manipulate the password reset flow, effectively allowing the attacker to take over the victim's account. This flaw poses a significant risk to user data integrity and account security for e-commerce sites running affected versions of the Thirty bees platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover of registered customers on affected e-commerce platforms. Attackers can gain unauthorized access to customer account information, order history, and potentially payment-related data linked to the profile. This vulnerability impacts any organization running Thirty bees version 1.7.0 or earlier with guest checkout enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators of Thirty bees environments:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit current configurations to determine if guest checkout is enabled, as this is a prerequisite for exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for anomalous password reset requests or unexpected patterns associated with guest checkout flows.\u003c/li\u003e\n\u003cli\u003eVerify if an update is available from the vendor that patches the PasswordController::resolveCustomer() method and apply it immediately to address CVE-2026-109394.\u003c/li\u003e\n\u003cli\u003eIf no patch is available, consider disabling the guest checkout functionality until a secure version is deployed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:33:44Z","date_published":"2026-10-12T18:33:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-thirty-bees-auth-bypass/","summary":"Thirty bees versions up to 1.7.0 are vulnerable to an authentication bypass in PasswordController::resolveCustomer() that enables account takeover via manipulated guest checkout processes.","title":"Authentication Bypass in Thirty bees PasswordController","url":"https://feed.craftedsignal.io/briefs/2026-10-thirty-bees-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:thirtybees:thirty_bees:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}