The vulnerability is an authentication bypass in PasswordController::resolveCustomer() that allows an unauthenticated attacker to reset a registered customer's password. By creating a guest order with the victim's email and using the guest secure key, the attacker can reset the password and take control of the customer's account.

Thirty bees installations up to and including version 1.7.0 are affected. Any deployment of Thirty bees through 1.7.0 that has guest checkout enabled is vulnerable. The issue exists in the front‑end PasswordController component.

The CVSS score of 9.1 classifies this as critical. The EPSS score is not available, but based on the description it is inferred that the vulnerability is publicly known and may be easy to exploit over the network. Guest checkout must be enabled for the attack to succeed, and it is inferred that this configuration is common, so the likelihood of exploitation is high. The vulnerability is not listed in CISA's KEV catalog yet.