thirty bees: Authentication bypass in password reset allows account takeover
Summary
thirty bees up to and including 1.7.0 contains an authentication bypass in the password reset controller (PasswordController::resolveCustomer()). An unauthenticated attacker can reset the password of a registered customer and take over that account by using a guest account token. The attack requires that guest checkout is enabled in the shop. A public write-up with proof-of-concept details exists, but no known exploitation in the wild has been reported.
Affected
- thirty bees through 1.7.0
- Exploitable only when guest checkout is enabled
- Fixed release version: Unknown.
Fixed in
- Fix commit 66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1 is referenced by OSV. No released fixed version has been confirmed by the vendor.
- Unknown.
Workaround
- Disable guest checkout until a fixed version is deployed. No vendor-published workaround is known.
Exploitation
- Proof of concept: A public write-up exists.
- In the wild: Not known to be exploited.
- CISA SSVC: Exploitation 'poc', automatable 'no', technical impact 'total'.
Our recommendation
- Check whether guest checkout is enabled in your shop and disable it if possible.
- Review password reset and account activity for registered customers.
- Apply the vendor fix as soon as an official release is available. If you use a source-based installation, test the fix commit before deploying it.
- Monitor for customer complaints about unexpected password changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official CVE record / GitHub repository github.com
- Fix commit 66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1 github.com
- Vulnerable code PasswordController.php (1.7.0) github.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- VulDB entry vuldb.com
- OSV entry osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:55.
Original description (NVD)
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.
NVD references (6)
- https://github.com/thirtybees/thirtybees
- https://github.com/thirtybees/thirtybees/blob/1.7.0/controllers/front/PasswordController.php#L182-L200
- https://github.com/thirtybees/thirtybees/commit/66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1
- https://hackmd.io/@leediay/SJc93G5ofl
- https://www.vulncheck.com/advisories/thirty-bees-through-1.7.0-account-takeover-via-passwordcontroller-guest-…
- https://hackmd.io/@leediay/SJc93G5ofl
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.