Thirty bees 1.7.0 authentication bypass allows guest account takeover

The National Vulnerability Database has recorded a critical authentication bypass vulnerability in Thirty bees. Identified as CVE-2026-109394, the flaw carries a CVSS score of 9.1. The issue affects Thirty bees versions through 1.7.0, as stated in the NVD record.

The vulnerability resides specifically within the PasswordController::resolveCustomer() method. According to the NVD record, this weakness allows unauthenticated attackers to reset the passwords of registered customers. The attack vector relies on the presence of guest account tokens, which attackers use to bypass standard authentication checks and gain control over legitimate user accounts.

Attack Mechanics and Context

The exploit leverages the guest checkout feature when it is enabled on a store. An attacker can place a guest order using the email address of a victim who has a registered account. This action generates a guest secure key associated with the victim's email. The attacker then uses this guest secure key to initiate a password reset for the registered account, effectively taking over the victim's identity.

This process does not require the attacker to know the victim's existing password. The NVD description notes that the flaw is classified under CWE-639. The ability to reset passwords using tokens intended for guest users breaks the isolation between guest and registered account security contexts, allowing unauthorized access.

Affected Versions and Scope

The vulnerability impacts Thirty bees versions through 1.7.0. Any store running these versions with guest checkout enabled is susceptible to this specific attack vector. The NVD record explicitly lists "thirty bees through 1.7.0" as affected. Stores that have disabled guest checkout may not be vulnerable to this specific method of exploitation, though the code flaw remains present.

No patch or fix has been confirmed yet for this vulnerability. Security professionals should assume that all instances of Thirty bees through 1.7.0 are vulnerable until the vendor releases an update. The critical severity rating suggests that the impact of a successful exploit is high, potentially leading to account compromises.

What should you do?

Administrators should immediately audit their Thirty bees installations to determine if guest checkout is enabled. If the feature is active, consider disabling it temporarily to mitigate the risk of account takeover. Monitor server logs for unusual password reset requests or guest order placements associated with known customer emails. Stay alert for official announcements from the Thirty bees development team regarding a security update.