PT-2026-1152 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Published 2026-01-03 · Updated 2026-02-03 · CVE-2025-15115

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is subject to an authentication bypass. Unauthenticated attackers can gain access to any user account by exploiting flaws in the OAuth token validation process within the social login system. Attackers can send requests to the /member/auth/thirdLogin API endpoint with manipulated Google ID and phoneBrand parameters to acquire full session tokens and account access, circumventing standard OAuth verification procedures.

Recommendations Versions prior to 1.7.31 should be updated. As a temporary workaround, restrict access to the /member/auth/thirdLogin API endpoint until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15115

Affected Products

Petlibro Smart Pet Feeder Platform

References · 9

• https://osv.dev/vulnerability/CVE-2025-15115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15115 · Security Note
• https://twitter.com/CVEnew/status/2007600725128352151 · Twitter Post
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-authentication-bypass-via-api-endpoint · Note
• https://t.me/CVEtracker/41319 · Telegram Post
• https://bobdahacker.com/blog/petlibro · Note
• https://t.me/cveNotify/147644 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2007613559711121691 · Twitter Post
• https://t.me/cveNotify/150769 · Telegram Post