Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109394Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

High 7.4

In plain English

A high-severity authorization bypass via user-controlled key in thirty bees from thirty bees. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

Affected products (as reported)

Vendor	Product	Versions
thirty bees	thirty bees	0 – through 1.7.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/thirtybees/thirtybees/commit/66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1 patch
https://github.com/thirtybees/thirtybees/blob/1.7.0/controllers/front/PasswordController.php#L182-L200 technical-description
Reporter write-up technical-description
https://github.com/thirtybees/thirtybees product
VulnCheck Advisory: Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout third-party-advisory