---
id: CVE-2026-109394
title: >-
  Thirty bees through 1.7.0 contains an authentication bypass vulnerability in
  PasswordController::resolveCustomer() that allows unauthenticated attackers to
  reset registered customers' passwords using guest account tokens
summary: >-
  Thirty bees through 1.7.0 contains an authentication bypass vulnerability in
  PasswordController::resolveCustomer() that allows unauthenticated attackers to
  reset registered customers' passwords using guest account tokens. Attackers
  can p…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:17:04.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109394'
references:
  - url: 'https://github.com/thirtybees/thirtybees'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/thirtybees/thirtybees/blob/1.7.0/controllers/front/PasswordController.php#L182-L200
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/thirtybees/thirtybees/commit/66410fd2a7ca9d1121a4b9551f59637ae6e4bcf1
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@leediay/SJc93G5ofl'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/thirty-bees-through-1.7.0-account-takeover-via-passwordcontroller-guest-checkout
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T16:57:59.914Z'
---

## Overview

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.