CVE-2025-15115
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authentication bypass by exploiting OAuth token validation flaws in the social login system. An unauthenticated attacker can send a request to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.
Risk Assessment
The risk involves potential account takeover without knowledge of user credentials, leading to unauthorized access to feeder functions, personal data, and possible remote control of the device.
Recommendation
Immediately update Petlibro Smart Pet Feeder software to a version later than 1.7.31, which includes a fix for the OAuth token validation vulnerability.
Original NVD description (English source)
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploiting OAuth token validation flaws in the social login system. Attackers can send requests to /member/auth/thirdLogin with arbitrary Google IDs and phoneBrand parameters to obtain full session tokens and account access without proper OAuth verification.