Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated… (CVE-2026-109394)

The vulnerability in Thirty bees up to version 1.7.0 exists in the PasswordController::resolveCustomer() method, which improperly allows unauthenticated users to reset passwords of registered customers by leveraging guest account tokens. An attacker can initiate a guest order with the victim's email address, obtain the guest secure key, and then reset the victim's password, effectively taking over the victim's account. This issue arises when guest checkout is enabled, enabling the bypass of authentication controls.

Successful exploitation results in complete account takeover of registered customers without requiring authentication. This compromises confidentiality and integrity of customer accounts, potentially leading to unauthorized access to personal data and account misuse. The vulnerability does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling guest checkout functionality to prevent exploitation of this vulnerability.