Thirty Bees EUVD-2026-97492

Exploitation requires that guest checkout is enabled on the Thirty bees store, and that the attacker knows the email address of an existing registered customer. The attacker must place a guest order with the victim's email to generate a guest account whose secure_key is then accepted by PasswordController::resolveCustomer() as a valid password-reset token because guest and registered accounts are not distinguished. Limiting factors: if guest checkout is disabled the attack path is removed; the attacker must know a valid registered customer email; and the CVSS AC:H/AT:P reflect that the guest-order/token-matching sequence is a specific precondition rather than a trivial default-config request. No victim interaction or authentication is required.

All severity signals point the same direction on impact but diverge on likelihood. The vendor CVSS 4.0 vector (9.1) correctly captures a network-reachable (AV:N), unauthenticated (PR:N) flaw needing no user interaction (UI:N) that yields full account takeover (VC:H/VI:H), but it also honestly encodes friction via AC:H and AT:P - meaning the attack is non-trivial and depends on a specific precondition (guest checkout enabled), not a one-shot default-config exploit. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no explicit POC/exploit-code flag was supplied, though a detailed third-party technical writeup (hackmd) and a VulnCheck advisory describe the mechanism, lowering the bar for a capable attacker to reproduce it. Net assessment: for an organization actually running Thirty bees with guest checkout enabled this is a genuine high priority (unauthenticated account takeover, patch available), but at internet scale the real-world risk is tempered by the product's small deployment footprint and the AC:H/AT:P precondition - treat the 9.1 as impact-accurate but likelihood-overstated for mass exploitation. No conflicting signals between the CVSS vector and the description were found; both agree on network, unauthenticated, conditional access.

An attacker targeting a Thirty bees store with guest checkout enabled places a guest order using a known registered customer's email address, which generates a guest account carrying a secure_key. The attacker then supplies that guest secure key as the token to PasswordController::resolveCustomer(), which fails to distinguish guest from registered accounts, allowing the attacker to reset and seize the victim's registered account. No working exploit tool is confirmed in the input, but a public technical writeup detailing the method exists.