Organisations face critical risk as Thirty Bees 1.7.0 flaw lets attackers reset user passwords via guest tokens

Organisations running Thirty Bees e-commerce platforms face a severe account takeover risk due to a critical authentication bypass flaw. The National Vulnerability Database has assigned CVE-2026-109394 to this issue, rating it with a CVSS score of 9.1. This high severity indicates that unauthenticated attackers can easily compromise registered customer accounts without needing valid credentials or prior access to the system.

How does the authentication bypass vulnerability work?

The flaw resides within the PasswordController::resolveCustomer() component of the Thirty Bees software. According to the NVD record, this weakness is classified under CWE-639, which relates to authentication bypass errors. The vulnerability allows an attacker to reset the password of any registered customer by leveraging tokens generated for guest accounts. This mechanism effectively circumvents the standard authentication checks that should protect user identity verification processes during password recovery procedures.

Which components and versions are affected?

The issue impacts all versions of Thirty Bees up to and including version 1.7.0. The vulnerability is present in the core functionality that handles password resolution for customers. Specifically, the logic within PasswordController::resolveCustomer() fails to properly validate the context of the token being used. This means that tokens intended for guest checkout sessions can be misused to authenticate actions associated with registered user accounts, creating a direct path for account hijacking.

What is the attack vector for exploitation?

Attackers can exploit this flaw by placing a guest order using the email address of a registered victim. When guest checkout is enabled on the store, the system generates a guest secure key for that transaction. The attacker then uses this guest secure key to trigger a password reset for the victim’s registered account. This technique allows the malicious actor to take over the customer’s account completely, as they can set a new password and gain full access to the victim’s order history and personal data.

What mitigations are currently available?

The source material does not confirm that a patch, fix, or updated version has been released to address CVE-2026-109394. Administrators should assume that all installations of Thirty Bees up to version 1.7.0 remain vulnerable. Until the vendor provides a confirmed update, the risk of account takeover persists. Organisations should monitor official Thirty Bees channels for security advisories and avoid relying on unverified workarounds that might compromise store functionality or data integrity.

What to do and how to stay safe: Thirty Bees

• Verify if your Thirty Bees installation is version 1.7.0 or earlier and check for any official vendor patches.
• Review guest checkout settings to understand if disabling this feature temporarily reduces exposure to token-based attacks.
• Monitor account activity logs for unusual password reset requests originating from guest session tokens.
• Prepare an incident response plan for potential account takeovers, including communication templates for affected customers.

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-109394?

It is a critical authentication bypass vulnerability in Thirty Bees that allows attackers to reset customer passwords using guest account tokens.

Which versions of Thirty Bees are affected?

All versions of Thirty Bees up to and including 1.7.0 are affected by this vulnerability.

How can an attacker exploit this flaw?

Attackers place a guest order with a victim's email and use the resulting guest secure key to reset the victim's registered account password.