PT-2026-1152 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Publicado 2026-01-03 · Atualizado 2026-02-03 · CVE-2025-15115

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is subject to an authentication bypass. Unauthenticated attackers can gain access to any user account by exploiting flaws in the OAuth token validation process within the social login system. Attackers can send requests to the /member/auth/thirdLogin API endpoint with manipulated Google ID and phoneBrand parameters to acquire full session tokens and account access, circumventing standard OAuth verification procedures.

Recommendations Versions prior to 1.7.31 should be updated. As a temporary workaround, restrict access to the /member/auth/thirdLogin API endpoint until a patch is available.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-15115

Produtos afetados

Petlibro Smart Pet Feeder Platform

Referências · 9

• https://twitter.com/CVEnew/status/2007600725128352151 · Publicação no Twitter
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-authentication-bypass-via-api-endpoint · Nota
• https://t.me/CVEtracker/41319 · Publicação no Telegram
• https://bobdahacker.com/blog/petlibro · Nota
• https://osv.dev/vulnerability/CVE-2025-15115 · Aviso do Fabricante
• https://t.me/cveNotify/147644 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2007613559711121691 · Publicação no Twitter
• https://t.me/cveNotify/150769 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-15115 · Nota de Segurança