thirty bees CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL thirty bees CVE published 2026-10-12

CVE-2026-109394

CVE-2026-109394 is a critical authentication bypass vulnerability in Thirty bees through 1.7.0, allowing unauthenticated attackers to reset registered customers' passwords using guest account tokens, potentially leading to account takeovers when guest checkout is enabled. This vulnerability exists in the PasswordController::resolveCustomer() function. Defenders should assess exposure, especially in enviro [truncated]