Vulnerability · Published Jan 3, 2026 · Assigned by VulnCheck

CVE-2025-15115Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint

Medium 6.5

In plain English

A medium-severity missing authorization in Smart Pet Feeder Platform from Petlibrio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploiting OAuth token validation flaws in the social login system. Attackers can send requests to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.

Affected products (as reported)

Vendor	Product	Versions
Petlibrio	Smart Pet Feeder Platform	0 – through 1.7.31

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Security Research: Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks third-party-advisory, technical-description
VulnCheck Advisory: Petlibro Smart Pet Feeder Platform through 1.7.31 Authentication Bypass via API endpoint third-party-advisory