Description

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-10-12T16:17:04.920Z",
  "pubdate": "2026-10-12T16:17:04.920Z",
  "executiveSummary": "Thirty bees versions through 1.7.0 are susceptible to an authentication bypass vulnerability located within the PasswordController::resolveCustomer() function.\nThe vulnerability allows an unauthenticated attacker to perform a complete account takeover by manipulating the password reset mechanism.\nThe attack vector relies on the application's guest checkout functionality, where an attacker utilizes a guest secure key associated with a victim's email address to trigger a password reset for that account.\nSuccessful exploitation results in unauthorized access to registered customer accounts, leading to a total loss of confidentiality, integrity, and potentially financial impact if the victim has stored payment methods.\nThis vulnerability poses a critical risk to platform security, as it does not require prior authentication or elevated privileges, effectively bypassing standard identity verification controls provided that guest checkout is enabled.\nThe flaw stems from insufficient validation of identity tokens during the password recovery process, specifically failing to distinguish between genuine password reset requests and guest account session tokens.",
  "technicalDetails": "The vulnerability resides in the PasswordController::resolveCustomer() method within the Thirty bees core codebase. This function is responsible for resolving the identity of a user requesting a password reset. The root cause of the flaw is an improper validation logic that erroneously conflates the security context of a guest order token with that of a legitimate customer account reset token.\nThe exploitation flow begins when an attacker places an order using the guest checkout functionality while providing the email address of a registered victim. Upon completing the guest checkout, the application generates a secure key associated with that transaction/guest session. The application's internal logic, specifically the resolveCustomer() function, incorrectly parses this secure key. When an attacker initiates a password reset request, the function fails to adequately verify the authenticity of the requester against the target account credentials.\nBy submitting the guest secure key generated from their own fraudulent guest order, the attacker forces the system to associate the reset token with the victim's email address. The backend, lacking strict check-access logic, assumes the request is legitimate and processes the password change for the victim's account. This effectively allows the attacker to redefine the credentials for any registered user, provided the attacker knows the target's email address and guest checkout is enabled on the platform.\nThe component primarily responsible for this failure is the input validation routine within PasswordController. Because the application logic does not enforce a strict separation between the guest order identifier and the password reset authentication token, an attacker can substitute one for the other to subvert the authentication flow. This bypass is possible without any prior authorization or valid session cookies belonging to the victim. The attack is executable over the network with minimal requirements beyond identifying the victim's email address and interacting with the public-facing guest checkout interface. The post-exploitation impact is absolute; the attacker gains full control over the victim's account profile, order history, and sensitive customer information, facilitating potential secondary attacks or data exfiltration."
}