CVE-2025-15115

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description The Petlibro Smart Pet Feeder Platform is subject to an authentication bypass. Unauthenticated attackers can gain access to any user account by exploiting flaws in the OAuth token validation process within the social login system. Attackers can send requests to the /member/auth/thirdLogin API endpoint with manipulated Google ID and phoneBrand parameters to acquire full session tokens and account access, circumventing standard OAuth verification procedures.

Recommendations Versions prior to 1.7.31 should be updated. As a temporary workaround, restrict access to the /member/auth/thirdLogin API endpoint until a patch is available.