EUVD-2026-97492

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest...

CVE-2026-109394

The Thirty bees software (versions through 1.7.0 ) contains an authentication bypass vulnerability within the PasswordController::resolveCustomer() function. This flaw allows unauthenticated attackers to perform an account takeover by exploiting the guest checkout feature. An attacker can initiat...